Extracted

• • Target

    SecuriteInfo.com.Win32.TrojanX-gen.27370.4621.exe

  • Size

    872KB

  • MD5

    ebb759f2c6d7817d44d4ebc7697589a1

  • SHA1

    93c1779663848ed2577db076eb1e5ac625a594c4

  • SHA256

    e6303d0730eaecd16e8a3becf77fce3d5da13155d2e27e102ecc2b700ad42814

  • SHA512

    22166ccf32ad1fcfd639c3825609e9d595db946d82d97bb20b25c49c114e2c676d5458348a1ea34293338004d8f0d5e5b81b899b993153a58f1d9fa946ce62d4

  • SSDEEP

    24576:kquhRLtMs3tJSZ4TjP7D7w2hT3/ronB7:kjXMiM8T3MnB7

  Score

  10^/10

  modiloadertrojanformbook3noppersistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2