Extracted

• • Target

    Delivery Report.exe

  • Size

    854KB

  • MD5

    8eca9c1d1031a98dc5f7900c31707473

  • SHA1

    a7a03da58b79d7d39a3705e1bba5e4a4aeb850ec

  • SHA256

    97c54d93ac31bbe3462242b5714804042342e581416c67b77dfd7494f77367b2

  • SHA512

    f2064609d8d957d063ce06bf7fef308ea00a8cfc3e02d7250e8b23fa39ddcf3d627963367826306b3db544b7926f7528aa6f82d5ae8747d1798a14a8250ad2b7

  • SSDEEP

    12288:zZ927jdTn4YRkAvIHenu/JdgQbug0lUxa66kXUqTfTB2O4rwSMpxA6Fs2Cz1dqX:zZU7VxRkwPusKAbpq7oOqLMfF8q

  Score

  10^/10

  modiloadertrojanwarzoneratinfostealerpersistencerat

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • ModiLoader Second Stage

  • Warzone RAT payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2