Extracted

• • Target

    cafb7d353313362efa3d09e9a4345c681bba522185870ceb930216d54ffe00c8.exe

  • Size

    733KB

  • MD5

    4f7199a3cf8228b7a1ea06157e033f1f

  • SHA1

    9c3dc25dc1baf8bea180d0ef6cdc7ecc19de3b5d

  • SHA256

    cafb7d353313362efa3d09e9a4345c681bba522185870ceb930216d54ffe00c8

  • SHA512

    3be7a80b373c81fc16637ad99ec84d185c3e2bb3e60c540f0dd60fbe1c85407caaf1ec2993a1114856a466fdb3763132e5d501bb5d8f16c179bad91322294d7e

  • SSDEEP

    12288:vE8us5hZIRFFRs4nmHQqtZua/3RvWEmhj+wzhd:MJ8ZIRFFRPnmDzuUmYYh

  Score

  10^/10

  modiloadertrojanbitratpersistenceupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • ModiLoader Second Stage

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2