Extracted

• • Target

    SecuriteInfo.com.Win32.InjectorX-gen.32696.11916.exe

  • Size

    782KB

  • MD5

    a5e7d643822b4bec515727dcb5a81654

  • SHA1

    378be3dff71b0a5486758091c71149202e19e78b

  • SHA256

    dc35d3d87c8f062b000472a46ec166c5bf8f399f95c02717eab4ce542043afd7

  • SHA512

    f3f7db1e7d2d05c0ffb96f829b1cc93692dc8130175e67398a9626e475f0a6472641cc57417a7ad39df765bb5b350b408b99bb98fe9621f6c082cd3c091241af

  • SSDEEP

    12288:9mHYsrAQMj7JP2cAmYOKe2ncjOQZ0RDFHNFap4nruadYaeLw2Y:s4ZljB2tOUAOQZ0Z1Hap4nya6RxY

  Score

  10^/10

  modiloadertrojanformbooknvp4persistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • ModiLoader Second Stage

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2