Extracted

• • Target

    JaffaCakes118_8ff43129c348ba7a6aba4328300a6f4d

  • Size

    437KB

  • MD5

    8ff43129c348ba7a6aba4328300a6f4d

  • SHA1

    f44565f65f81b2be21b33a3221a7865529fdc363

  • SHA256

    ac213b1d8331ee8203ea10b89efddf288b8de75cfee6238e83e05458b607f0ac

  • SHA512

    afa0f187dace10027e434a5d72270b6d2987dcf004c46e585072208cbdede654838c464f2131e4e167ce609c970eac278cb65372f36c4a2538908c0b42d73907

  • SSDEEP

    12288:CUi2iN6U0HWV1HGJIHZTrcXvA7Xxz90aiir:CUi1D0K1mGHZTe2XlOaNr

  Score

  10^/10

  xloaderp0ondiscoveryexecutionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2