Extracted

• • Target

    ADNOC UAE EOI Acknowledgement_Form with VENDORS AND CONTRACTOR ASSESSMENT QUESTIONNAIRE/ADNOC UAE EOI Acknowledgement_Form.exe

  • Size

    38.1MB

  • MD5

    4ea8fa4b561e8e02dec82bb2f1d27dd9

  • SHA1

    12bd71ef9b6101a799e60504870e56a43f617e3a

  • SHA256

    05c15672fc9922839ac2f97c9cb82c788cd07950207663c69d0a675f4352d988

  • SHA512

    ef1c3459f2b28df4700f25dc965a85f021f98b39f018ce171bf24849043c6c60da516cbb569259dd767101d0c952002cead8176a5720a60237db8a928eb9c66a

  • SSDEEP

    12288:eu4PodWtXBGdM473moqdPO4ACBsH/LrZuWpnKlG40hryUOn38YvfPvfofHQsr0Sa:ZQoYBGdM4KoqPAPfXZuW0GS8YvfPvxu

  Score

  10^/10

  modiloaderremcospersistencerattrojanmixture-feb-2023collectionspywarestealer

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • ModiLoader Second Stage

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    ADNOC UAE EOI Acknowledgement_Form with VENDORS AND CONTRACTOR ASSESSMENT QUESTIONNAIRE/ADNOC VENDORS AND CONTRACTOR ASSESSMENT QUESTIONNAIRE.exe

  • Size

    42.0MB

  • MD5

    036b133cc0c9d11c5e149cfc8b843d26

  • SHA1

    651bb20a6e7066590277a66779b00a8cc091d74a

  • SHA256

    713fa6ae0a53bb384b410fd88680056a9ef2689d54d141610afc07a63403e06e

  • SHA512

    249671477b67c99572ea146cc6b1b55f93d2453b62be642408f0cc6d5fa214d9d7502d5d98427fb3e443f9f73afe96f3f63048c28fb8f76a590a37ff79e35e34

  • SSDEEP

    12288:eu4PodWtXBGdM473moqdPO4ACBsH/LrZuWpnKlG40hryUOn38YffPvfofHQsr0Sa:ZQoYBGdM4KoqPAPfXZuW0GS8YffPvxu

  Score

  10^/10

  modiloaderremcospersistencerattrojanmixture-feb-2023collectionspywarestealer

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • ModiLoader Second Stage

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral3behavioral4