Extracted

• • Target

    Nova narudzba u prilogu.exe

  • Size

    602KB

  • MD5

    e827a30064936b58c6f789623317f491

  • SHA1

    79ce624d096ae63e68f3ac5c1096684130b7e609

  • SHA256

    1d8e5ebbfd116c875add08d4a4b4a37ef0361b28f9e9cbfd0690bc81206338c6

  • SHA512

    c516e1253da0b6e65662fb297558f09763114ca0804755f66a4b4985cfe37a7988d4087f956556514036a62b5783c8fe140b18b23c9d746c40590359fca647ea

  • SSDEEP

    6144:WdE8uEDkEfQQvbaGrYddRe+51qjREwCZfc7RO5E4Z1eFEZpIismTxg9FromA2Rl:X8lDAjGrc7G2wCSOn1kOpIiteSmvf

  Score

  10^/10

  modiloaderxloaderuj3cloaderpersistenceratspywarestealertrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • ModiLoader Second Stage

  • Xloader payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2