Extracted

• • Target
    PO Intm 9005697873 RELIANCE RETAIL LIMITED.exe
  • Size 965KB
  • SHA256 9380f842781eeb483f61572a8a327221cddc6402ce15807dd6746c31d40c3bb4
  • MD5 1b2dd3607ce4fca4727ebc335938a771
  • SHA1 0ca84bc66a59d51fdf54deb4d6bacd89427302b8
  • SHA512 caf87edfa71b3923b3dae136776ce7964b95c793c57bb6d77c8f4806a96e2d874ee4a899435c59ea4acbc80b221941a98ebb691d3d287aec61667a27f76fd300
  • MD5 SHA1 SHA512

  Score

  10^/10

  modiloaderxloadermnqoloaderpersistencerattrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2