Extracted

• • Target
    kopje e pageses bankare.03302022.exe
  • Size 965KB
  • SHA256 56958cbd9007cf88fbf7bbe0ab8cdd745af7c3cb43f495cf12ef37cace388bcb
  • MD5 534a0175326d3fc9d5f9769832c58221
  • SHA1 ced15f93cebf0254c112808aa9dc6637da6861a0
  • SHA512 aa1d9f4d47e1bb0fe78d22ca5d08dc7cfa1fd50a404be25db935cb7b1ce6596fc070453540c9fa0b8f619c51626bbc031aeb8167653195ec2cadde51a6fbbc7d
  • MD5 SHA1 SHA512

  Score

  10^/10

  modiloaderxloadereuv4loaderpersistencerattrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2