Extracted

• • Target
    54cbaf431313a0936f684aa2a187934f
  • Size 899KB
  • SHA256 239419437726bda1c5401f36629aa95050346433232192947ca54890ebb8a39f
  • MD5 54cbaf431313a0936f684aa2a187934f
  • SHA1 a1db641fd6a2ccbfd305e92bc61d86803d1523bc
  • SHA512 05cbef7cd12f6e9b96d917213d8be5863d0df440bab073e78188ba6ee98a439cc9a7cc1e2a53fc5b78ffae5495087817b654542a1d9a08db536034281f3823fd
  • MD5 SHA1 SHA512

  Score

  10^/10

  modiloaderxloaderxtefloaderpersistencerattrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2