Extracted

• • Target
    JaffaCakes118_351b0b74944773c3c36d417eef151670
  • Size 989KB
  • SHA256 3682691140da912f7a282b23de9aaccffa2ad8178665e6a8ace9d745a8fb8cde
  • MD5 351b0b74944773c3c36d417eef151670
  • SHA1 4109a31f036efef7ea222d25cd0b3e4e0564533b
  • SHA512 e9c85320fc24e77d54c85b49cc73233bd6f1cbd492bfe6d3c7e6bb54743f7b93d796e99784e0b63529dbc7a5c878e35f87aaa370cb40bd99a723a0ae2dabc642
  • SSDEEP 24576:wm8hzilPQ+ZT1AmUoalioH1Btq9ZaQax:t8lSnZTBv0dHdqmB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  csv8discoveryexecutionxloaderloaderpersistencerat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2