Extracted

• • Target

    JaffaCakes118_87970c3d479f52f00f2b9de1ea942717

  • Size

    464KB

  • MD5

    87970c3d479f52f00f2b9de1ea942717

  • SHA1

    751d93f7f3025d9c5487cd3382b082d89f38da8c

  • SHA256

    62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6

  • SHA512

    9e0434b917713b39621aff4253ec07fae3b2f7399c9293acd2243e09c091f1713df532e5bfb66fc25926cd0bec2456ec62b57ed0f685ad00e94e1d4d2c279c57

  • SSDEEP

    6144:HrO6Uqd2GhN4KjRjaScAkINt1Vmh/4a2c3zBFlBKAHUt43LnWCktAE:HPUi2iNTRjaScAknLNn0P

  Score

  10^/10

  xloaderb2c0discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2