Extracted

• • Target
    06caaf6b145d447cf43f2339969310e9.exe
  • Size 941KB
  • SHA256 f19e89af57e97f541ddebcd6f6dcf8b0f3ab549aa426af722287bc8ab18f8d50
  • MD5 06caaf6b145d447cf43f2339969310e9
  • SHA1 7698e164c4d68e4d2dc140c5004625950d43d474
  • SHA512 f86e28e3f16d50a9c7cf44a5c07a4e92646ca544fbaa66a35db3163d186d75a06c7fcc46fcdf374a770a1ac2e2cb092e3675931b2c407f03add40028e53c74af
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookmodiloaderxloaderloaderpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2