Extracted

• • Target

    85ba889a32a7f05f10259b60b5b99489392865c025978171d93c9074a7cdb84f

  • Size

    936KB

  • MD5

    4e88286476d26cead4caafb1231ec062

  • SHA1

    e7051669e96f7c80b8affc1554d0fa6e9fad5117

  • SHA256

    85ba889a32a7f05f10259b60b5b99489392865c025978171d93c9074a7cdb84f

  • SHA512

    06de3ec1d5d4f018b8ce9af031c2c37f89e09bd6c49b3a33f774a7bcb00ef3160906b4a8fcc3a93d1b5324bb05c2c4e57ebe6776524125c57585f790452b9e23

  • SSDEEP

    24576:J6K2h1iVrItFQWGKN+NXN40JIyLrFHDvk:J6K286n+NXmWb1j

  Score

  10^/10

  modiloadertrojanformbookg2vppersistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • ModiLoader Second Stage

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2