Extracted

• • Target

    387263527630093.exe

  • Size

    1.0MB

  • MD5

    0b92c0d90964c501b37a944c5ccc01e3

  • SHA1

    36bbbc5bcb3ee4aaf7c7cd6034733a6b5504e38e

  • SHA256

    74b472ebfa120b3c19287ed837c243b65de17bd647eea036d338b17f5e2ec548

  • SHA512

    d01192e005143bc39eb8e020fee37fb6b831ac7c5e8503d8ccea7a2ff83801c77ea4b1f5b5c3272bccde07bef3699347480ad1dfa101ae037ec0c6cae841dd70

  • SSDEEP

    24576:v6R9yfVUXwTEfF59XADz3OjaZQQJ0nhUGfApjLM:v6mO0MF59XADzejakuGfAtM

  Score

  10^/10

  modiloaderxloadereuv4loaderpersistencerattrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • ModiLoader Second Stage

  • Xloader payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2