Extracted

• • Target

    Angebot bestellen.exe

  • Size

    1.7MB

  • MD5

    32165a044899184c6231b9a194d729e3

  • SHA1

    2b1b1e1ef64c1e150ba43d8fb4d59ae9fd74e68e

  • SHA256

    0823db6cc251f5500ccb441b6751132721b188a9b622d6fa859ee37149bff324

  • SHA512

    cfd478382375a07d298d12775e7e66b3efbee9d5736f735e830e14520ece1b2215b3e2e392ad27a291bd2720981183cde40ef87af07f946dcba894286b7b75c7

  Score

  10^/10

  ratpersistencetrojanmodiloaderspywarestealerformbook

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook Payload

    rat

  • ModiLoader First Stage

  • ModiLoader Second Stage

  • Adds policy Run key to start application

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2