Extracted

• • Target
    SecuriteInfo.com.Variant.Strictor.277376.15002.14548.exe
  • Size 662KB
  • SHA256 5e4a76f6e138e48915a6e38f071ca4e56f081cacadf102441bc188531a90ca1b
  • MD5 287da5567524a563b041a758c2e06d7e
  • SHA1 a49437171d0b096d09bcf5bb0d69113db005818d
  • SHA512 2db32c3757efe960fec4686380e5a9358964cf66d49d851ff71c2c04335be3c60cc20a4891ecfccc4838aabe2138a02ae85019a9fc8fa0c3284ec1766dcab84f
  • SSDEEP 12288:KQx6TuE22txKuedaLJS71RSfYFQwdv8gRwowEl52joH:Hcx22txKuedao3SWrVN5R
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookmodiloaderxm33persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2