Extracted

• • Target

    SecuriteInfo.com.Trojan.Siggen18.52433.24924.20991.exe

  • Size

    742KB

  • MD5

    cecd0e8e9b43caa70606fcb5a6193a76

  • SHA1

    b7b3fa7b44446644a3a7f7b89852e8fde90c73b3

  • SHA256

    1b1d355eb5f82bf03c063948005173e8dcb3d5051c7dc047dadbd471eca9cc87

  • SHA512

    d0c184c8962ce3a4aa175088d3ef926ed086be7d557f6fc8d8cab0d7f02d801979f2c36c90b8edfce00bd8553552195e6a00390227d62f1ea67ac4aabd319ac5

  • SSDEEP

    12288:X1vdLGEt9CUvF8rhmJ9pKOBEffIll6A4qFEPnjDZA6pbZe:lFBt9CUd8rhmJ9rOfehF6njDJpbZe

  Score

  10^/10

  modiloadertrojannetwirebotnetpersistenceratstealer

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • ModiLoader Second Stage

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2