Extracted

• • Target
    Gkjesdjokhownhmnzenqhirureonvyzjao.exe
  • Size 715KB
  • SHA256 5fabffc9eb6177ac29a1e51bf2a8bde55ddd97e2f7c86134eb2512b927f1232e
  • MD5 e339968bd4859d65b757ef83159b0488
  • SHA1 136c9c38a58ccbc9c6bebb48bba6100fc6eff206
  • SHA512 d134f5c7a6fbb61f0c4645e539b318e8dfe7eb83cfe9bfd198e5ea4161e3ab0aa5dd4148a6ba8454363080c483ca9225b3fa708181de7f86617fc24427280536
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookmodiloadero2e7persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2