Extracted

• • Target

    Novy zoznam objednavok.exe

  • Size

    914KB

  • MD5

    57c242b8773d84a2bbbd0bce804fedbb

  • SHA1

    f5024d3caadb3753ee4ee6a2d86c9fee6529f73a

  • SHA256

    fe323cd5a46b973a6e0ade0cab099d0f929351820421393b29c2a63df6cdd527

  • SHA512

    e94af4b28b15ef6ee311958bd4cb428a736e90e3054409375e2d1749052610c8f3e9e10f91cdee6f3556040e396bc72e10b55b887fa5033fd5dd6c83ae8c1821

  • SSDEEP

    12288:PcZI0RpZLWuz11zDo3A0eMqM1PyYiDuB6ZGK7jq8OMEI3c41RMCoqlkXWt9Nt1/Z:P4PZKkn8feMqMY3+6HyLwrbMr7c

  Score

  10^/10

  modiloadertrojanxloadereuv4loaderpersistencerat

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • ModiLoader Second Stage

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2