Extracted

• • Target
    rápida confirmación.exe
  • Size 701KB
  • SHA256 c7014edceec0fbe638312dcec8b8d1f0a5bf88dd282fc8ae9ec5d375820d270d
  • MD5 3e9eee8807a79ad0134c1a6402927ffa
  • SHA1 c89df349f144a0cce0dce3a47efc5a9e37b46d56
  • SHA512 11f6f66bdda695547f1a9eab4d0005e72f08b5a3ffff51404cb12ae66e235672d38fd92f0a925da23d1b5b6488b08d58d4710cc86bb6f9b6a347bffdbb6e2377
  • MD5 SHA1 SHA512

  Score

  10^/10

  modiloaderxloaderarivloaderpersistencerattrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • ModiLoader First Stage

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2