Extracted

• • Target

    SWIFT.exe

  • Size

    847KB

  • MD5

    24b58901a371adc86a36b7cc1189f2f6

  • SHA1

    4421669b2b505db421e5ecb36119aee48ade108f

  • SHA256

    a2231cdfce2e5ec3adcdb8535b1663da96d390e65c0f0c83c385a96d97790f0e

  • SHA512

    8ba3252a9722e0e32a1bf2a6ff3ce51127a02df32bf56bed9e771aa7cde80853a0d1475bef10e3cbd2dd9592b3b1950fb3300536f37ebe9961e06140df7ef795

  • SSDEEP

    12288:m8rLgxLKQfJJuXFI3MU+oVv6G57D1l0JttQCMO+U1xldIuau/T2SAzCk13h:RrLgO0023ZQK9qEO+U1xldqu/T2SADh

  Score

  10^/10

  modiloadertrojanwarzoneratcollectioninfostealerpersistenceratspywarestealer

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • ModiLoader Second Stage

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2