Extracted

• • Target
    SecuriteInfo.com.Win32.TrojanX-gen.27370.4621.exe
  • Size 872KB
  • SHA256 e6303d0730eaecd16e8a3becf77fce3d5da13155d2e27e102ecc2b700ad42814
  • MD5 ebb759f2c6d7817d44d4ebc7697589a1
  • SHA1 93c1779663848ed2577db076eb1e5ac625a594c4
  • SHA512 22166ccf32ad1fcfd639c3825609e9d595db946d82d97bb20b25c49c114e2c676d5458348a1ea34293338004d8f0d5e5b81b899b993153a58f1d9fa946ce62d4
  • SSDEEP 24576:kquhRLtMs3tJSZ4TjP7D7w2hT3/ronB7:kjXMiM8T3MnB7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  modiloadertrojanformbook3noppersistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2