Extracted

• • Target
    ONEYMESC15768700_noncopy_20230124102200.exe
  • Size 702KB
  • SHA256 6f898510dabd717ad5b9a0057dc3a2e89d69a0fe8ffb5b8c50183e767bfee34f
  • MD5 36802a63e5494320495544bb817b4bcf
  • SHA1 3b4c99b73b5c22d6b354ec870839d0a30722a83a
  • SHA512 7e4554bc4fa7bc839c13e0aa0ad25b3784eddec7e66cdf52ad5a9025c065fd36756fcef0367e7ecf20830fdc6fadfccec7b09a710c6e356bff802da66ba5dd04
  • SSDEEP 12288:Z1HbJXPhvoavMSPJ7Q7/S7sW/vCFovXe84SfPt3C:3lXZAavMo7Q74sECFoGhe1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  modiloadertrojanformbookxm33persistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2