Extracted

• • Target
    SecuriteInfo.com.Win32.DropperX-gen.11338.19707.exe
  • Size 699KB
  • SHA256 03daa8dcea75f814b344785dc1f52222cd4461bccc17a35f032efe81e47d18be
  • MD5 b3d1c442f9b4d657dfe090da69c87751
  • SHA1 99c32ecb6d8a8c7e78a908cd09b32bac0502885f
  • SHA512 cbe8a77d73751455518f5a28dbbcfd16e395858690e1b57c812a0a008b88bdc1dcd49894c205f6f59f806c0342e3be2eda7c96fdbc98d5c5659deebf513e050e
  • SSDEEP 12288:snVmudzJUo8PhrmipEsHrt5SslxqAoAYyNG/xhIL/2nSrJWIXnyGS:sVm4Uo8ESLbS8xCaG7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  modiloadertrojanformbookt3c9persistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2