Extracted

• • Target
    New Order.exe
  • Size 909KB
  • SHA256 7346088c6adad4d688daaf90b49a1f2a985ba4ae09b1a3e5351ee28e22ca23ed
  • MD5 43672794e383a2d256df77a3155dbae1
  • SHA1 c90b991b89ac4f58d32cfc353505f394f0ac0da4
  • SHA512 c224f95d2c9f2dac1bda58cc678e4b923a209ad78a0f3f1ecf04b21b3d628644c1667340e3ac7a9f2f81804382e1eb873aa6a6a5b27ec8068542a5123ea27ef7
  • SSDEEP 12288:RSLxZ0EG3KQyTs4XlhyI/vbU17yZP/sqUpQZZQhQmXhng3AXgv1C0vm7/91:RSU72nsLuTQQmXJgQQtC/7H
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nvq4discoveryexecutionxloaderloaderpersistencerat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2