Extracted

• • Target
    Invoice#1904387674.exe
  • Size 1.0MB
  • SHA256 e2c591e76cb0e5c7e5883a4180c2d7286a4a80a5c3c83c062a8f666e0764c1dd
  • MD5 99e7613dbe78fa96a28c2abb94fa65a4
  • SHA1 a22625921195979fd16e5cc35dec3c735a0d57c6
  • SHA512 ae2f04dee6b26ab3429d047303458072787786d7c72140decf790cb6a8ed4beb35599e1385e2924a81df3be9bdd2361842c96610b2d2e9e6849f237ad936da95
  • MD5 SHA1 SHA512

  Score

  10^/10

  modiloaderxloaderjdn3loaderpersistencerattrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2