Extracted

• • Target
    bb923d7bf89149cbea7ce08ee333babc
  • Size 388KB
  • SHA256 38444024682d6ea391135d374ecd6f457bb01df512801e25fcbd2931afe58d92
  • MD5 bb923d7bf89149cbea7ce08ee333babc
  • SHA1 33bef4380d7473182f706546fcff7effddda9bc9
  • SHA512 5c139fdc917b7f63694eb9e11fb7a697b97c6fd7628e71e137fe7dbb9fd127894589c14286de4809d91b7d08ecb22aef3c6015d86a244d9a466210a262f39f0f
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloader8gceloaderpersistencerat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2