Extracted

• • Target

    1b0be50f700de57af68f6ed4c97f2b3a8e28ea5ab4bcd977aa6799553803edba

  • Size

    709KB

  • MD5

    e27fbadf3b4c680755af9286b4b6cf6b

  • SHA1

    cfa2a558737840f956c7726c905b64fec5c2b472

  • SHA256

    1b0be50f700de57af68f6ed4c97f2b3a8e28ea5ab4bcd977aa6799553803edba

  • SHA512

    34391dfdc5dc1c5f8e1437b590cae7fdfa93c3e95a3c4bde32b581b5c1a5527e5c9372859d14be752fd7252d52ace2cce550f79742fd879e9096d92f5aefc65c

  • SSDEEP

    12288:jBL6dBqd7X5BqO2VaHuD/etbrU9+/vqy5g7i+zAXrc:1WyXvqOiaHuD/eRa+/vt5F+zy

  Score

  10^/10

  modiloadertrojanformbooknvp4persistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • ModiLoader Second Stage

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2