Extracted

• • Target

    PaymentsSlip.exe

  • Size

    899KB

  • MD5

    49f570ee00750e7371ea4dfd4a274216

  • SHA1

    9ec78b1a99c27c22be8ab837997cd43a7c0561bf

  • SHA256

    f0949175ee4c6e72f3405816aac82be2863b1c6a01734e5750883da1362aa5ed

  • SHA512

    d3d9b59627b951c55a15feb83b25b44ff2a06ba4da06e678febe20aa53f0847dcc8c2fa90cf6812642b323e82d840207002c6322cb720725513ea7f02146b29e

  Score

  10^/10

  modiloaderwarzoneratcollectioninfostealerpersistencerattrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • ModiLoader Second Stage

  • Warzone RAT payload

    rat

  • Sets DLL path for service in the registry

    persistence

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2