Extracted

• • Target
    order.exe
  • Size 688KB
  • SHA256 81f4e3b64cd382fe241f3ce5f0f31eafca0fc82c77c91b751d03f8eb41511b3e
  • MD5 c4244a4b3c4b9f010952f650f741debd
  • SHA1 22da99fe11024705d53b2013d03f4bede12b2dbd
  • SHA512 64bc1e9c8468a5a093731ce7e36a7d719f7c690031f83655d4b8c1b24515c5e550b3031a0b231f352b70419b9dca88e662b50dcc2dc11954578d16a200f33869
  • MD5 SHA1 SHA512

  Score

  10^/10

  modiloaderxloadergebgloaderpersistencerattrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2