Extracted

Extracted

• • Target

    TSDPL for GSTR3b.exe

  • Size

    813KB

  • MD5

    96687cb64b98418c573ee65753a72e33

  • SHA1

    d20ada54342596cd29bf7f66bc86d4503c4cfea4

  • SHA256

    c410af32a481222f15dd9babe626182317e7d76d603d2eb001cccd213a258873

  • SHA512

    b9f4e51985e839ece1f1bfb74ce1c0ffa232f848cdbef5a1c65ed3e703096074b779b509c1369060a96e924d4eae7e80049639e886923271b4d576ca725746b9

  • SSDEEP

    12288:vOrAkZrlpZxc3NKqgw9ONuRJooNN5dHVqTdTB2O4rwSMpxwhxjgV:vs3hp4c6/n5q5oOqLM2x0V

  Score

  10^/10

  modiloaderwarzoneratcollectioninfostealerpersistenceratspywarestealertrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • ModiLoader Second Stage

  • Warzone RAT payload

    rat

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2