Extracted

• • Target

    6B4878E4AEBFF478C4E55A2478EEF8B80D6EC46BF7B9EAE797E45C9AE78A188F

  • Size

    622KB

  • MD5

    0e28ab44ff7eaa74be08eedba3072f99

  • SHA1

    0614f14830b92f7e4229a8c28470f9d8d43a760c

  • SHA256

    d6e7274f9866e7f1fff9bb501a4b5a6d995529115760aec4760e84c2699473b1

  • SHA512

    88ecac3571b22bc38cd1f95d806baf8fe62000add4238b80ec56faa3c2bba9255a79384f1e36c8bcc83d3306a436904df71cb4f5e85549a3c7e1a77c0ca38d26

  • SSDEEP

    12288:yCcEnCFtzHTM75t9EPlJr7QlRKXrzAXrcYqI:yXECzHTM75tMD7gqrzycI

  Score

  10^/10

  modiloadertrojanformbookkmgepersistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2