Extracted

• • Target

    TKM Teknolojik Request order Document Specs 94859675.exe

  • Size

    883KB

  • MD5

    77321c3b7913f9ea3d70c8901e6e7acc

  • SHA1

    3d360ee32dc1ec1d9f050aa6dcc7722c837f7e94

  • SHA256

    31a20253af2b351eac7922198159d9b73a032649e942da764bc6811e7b95ab34

  • SHA512

    521a380f7f28f1e398426e92989fc6c7c1bb0ac9b55b1f5ea1d279cdafbc9c21e1bdb0cff8ae676993c46acb255e6f3b238e3c4e511130c3b37e4f8f63a179bd

  • SSDEEP

    12288:fb8A+lyMML0gN55kXFyqf0bGBvGoE05qhAf1nAhglR:f4ZzML0gN5WXFaK9GoEUf1nAhglR

  Score

  10^/10

  modiloaderremcospersistencerattrojanupspywarestealer

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • ModiLoader Second Stage

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2