Extracted

• • Target

    dbbd5f34648cc1a20d0022c47a6531a6.exe

  • Size

    940KB

  • MD5

    dbbd5f34648cc1a20d0022c47a6531a6

  • SHA1

    84bc195e56cdc6804cb987af330608ef5b173a67

  • SHA256

    f8612ea8ab764a3d09157a9b90dc418ec2a7b8af22b29ce63d375896f9ec9a28

  • SHA512

    6d44509bfb38afe4490034736e20dc59cd97de0a4e8cdbdddcd353f7ba5a470a1288f6a2761fa31d4c81bfdf0f6dc8cd56581e27f138e783ecea3e520d9819b3

  • SSDEEP

    24576:xuLJQ0+ai+JoMCXlTjcEa0s4Tj29W8AoqiVNWI:xUpRx+cEa0Q

  Score

  10^/10

  modiloadertrojanformbookchofpersistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • ModiLoader Second Stage

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2