Extracted

• • Target

    5576a672ade73b26e1d758c027a867333987d3d2416ed9a726180fb4227a2786

  • Size

    520KB

  • MD5

    8717d55dac4f12cf84a3b349bdd9823c

  • SHA1

    6281203d0ed33f80dd9f0a18e1a65d271d8213da

  • SHA256

    5576a672ade73b26e1d758c027a867333987d3d2416ed9a726180fb4227a2786

  • SHA512

    5f5b6fab98c389563618f274e7985111221965889a034576c570262063d619d5bcb2dab77a26f9f136c620ba1e965f6a6b13748ff8b81d07555a2f4d80cfaabe

  Score

  10^/10

  modiloadernetwirebotnetpersistenceratstealertrojanupx

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • ModiLoader Second Stage

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2