Extracted

• • Target

    Dospjela faktura.exe

  • Size

    885KB

  • MD5

    e128d5970cc2d13408916706d4191d55

  • SHA1

    3405ca7211ed488ee29143783cc98ff91c78efb2

  • SHA256

    f7dfefe374452d90bc99631bdd38de65f37ff3aefabaeb525aa2b3d97c6680b5

  • SHA512

    f0d4424a75512e95d7934e8c643ac7807fec678e72c4593c62afc90fd22f9220462b27c1f0a23d27c2c0e4c80b17c15c334782c4aa1ebb7b951316b906584e56

  • SSDEEP

    12288:+dvSgikKHSXrFGZ/1nPaPih+gTiwCAI5T7grmN7vwui44YXas4E+Jymf7fv:+dkDSXrAzaNaizeaNydYXas4E+Dv

  Score

  10^/10

  modiloaderxloadereuv4loaderpersistencerattrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • ModiLoader Second Stage

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2