Extracted

• • Target
    7c94aa32389a4c60deaff803f672082f
  • Size 965KB
  • SHA256 f94b77c7de3e47949556c797e2fac84ada108a52ea67a57d9658fe9cc149b148
  • MD5 7c94aa32389a4c60deaff803f672082f
  • SHA1 0e688568806720e4044b824dbaf3a7a89c4e41d0
  • SHA512 4da698c60c3ed38e6aef918a0d90818a96b509e70b35e8baaa9b78dc1f9a68c95d3d207d8dc51e58a2afa641f2a5dd2c52cadb7ee703ee8b6d451e29f828be6c
  • MD5 SHA1 SHA512

  Score

  10^/10

  modiloaderxloadera2c8loaderpersistencerattrojansuricata

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2