Extracted

• • Target
    SecuriteInfo.com.Trojan.DownLoader45.30414.6829.20660.exe
  • Size 922KB
  • SHA256 f6ddc63173d134db79db880c7f5b338987f31ddd36cfcb27cf15e3bb08a507bb
  • MD5 a3d4a9013e45abc92d09df37ace8ae2e
  • SHA1 8e38b20353cfab602adc5d50be25af3d715ad40a
  • SHA512 0bcae0af7e61c08888d67007690e1f7f4f812e80ac6cb6787c6651ff56b6ad6e73858b0b7b8bcc0a1852472815efee8bc53869aabb0990bdfefdc419c7901c07
  • SSDEEP 12288:qWdBhhjaODNTUl3qMMUHTf4zq+6LuLfxxH1ukXW2tj49UOOG1Rr3Srq0kRDiom:D7HjNUl3qMpzfnMxx1pXlRPBmMBeD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  modiloadertrojanformbookkmgepersistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2