Extracted

• • Target

    SecuriteInfo.com.Win32.SuspectCrc.23812.23342.exe

  • Size

    634KB

  • MD5

    b48fbd453403d09c8eaf4b617ebeebcd

  • SHA1

    6567212fac086e07777de8fb30807315fea3aeac

  • SHA256

    4ef967caea627a1b9cd7f74d31584b69d76f8c532cee528e8815c4f70ae24aa7

  • SHA512

    343ea575ceebfb1b7e61ad527902f860c9431c83ed3231112a02495ec83f24215ffdfb4a09f4d2d3ea050bb176e9fc3f37535ba5dd4744ff973bcc529d87216d

  • SSDEEP

    12288:zytjRg5fcPrlI7o1wWGKSoLPS8jY199t9OxOm4pMn:utWcPpI7oOKlLPfY9DwxOvpMn

  Score

  10^/10

  modiloadertrojanformbook3noppersistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2