Extracted

• • Target

    tmp

  • Size

    936KB

  • MD5

    15c6da72eb32ee1b8ea97d4320a39dff

  • SHA1

    0033e3c5bf6d98124f273a68e3b0da9d12ea56c0

  • SHA256

    5a116045f9e40be64ae46a63626844ed4dcc5a921485b681ebdbd217664e1342

  • SHA512

    a3c5a3560e0fc07ce5b0d30247bda41eb71ec17b2423f586735262055d9e45c3d7421b714931935eae23aba0f273ce7e686cf595d22563052a4c6bb8ac3ff990

  Score

  10^/10

  modiloaderxloadera2c8loaderpersistenceratsuricatatrojanspywarestealer

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata

  • ModiLoader Second Stage

  • Xloader Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2