Extracted

• • Target

    Kvruwfvhsjzetg.exe

  • Size

    1.1MB

  • MD5

    f642f03706a86b22eff5b8764edaed56

  • SHA1

    8a3a217ebda9437299765e7eb246494305086c01

  • SHA256

    d6c7872a47c2b39878c40fc9e9af3fe41c829d425814bdc331d4c2b48efc7f19

  • SHA512

    a6632ce0eb90359678e32d54073040b99d5cb498d80ebda17acc833830db89234f924623293497631eab4e3f0538c6acde6111a38b0e55e29f1669a2d71f9219

  • SSDEEP

    12288:oX8lOqFSsZ40z3QjB2lr5fPx7Zh70WoQzV9hBoSFhAf1nAhglR:Q8ltFSQ3AB2zp7pcf1nAhglR

  Score

  10^/10

  modiloadertrojanxloaderuj3cloaderpersistenceratspywarestealer

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • ModiLoader Second Stage

  • Xloader payload

    rat

  • Adds policy Run key to start application

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2