Extracted

• • Target
    Yeni siparis eklendi.exe
  • Size 769KB
  • SHA256 c7f2a0affba4248f4b27486f35c2c91fc27c210bc3d200ddac825b7ad5341d30
  • MD5 57fda92eba26470e5269afd0137f197c
  • SHA1 fba7aa814defbfb093407da33f1e3d6357301465
  • SHA512 194d685f0479d456e1849dc2de44e4d56cee32affa4c99acfcfd6626c53a56e4bca3c8963d3317a639579f4c8692df401f8a5d748846f5f6d837034720c8d6c4
  • SSDEEP 12288:cjtATpxC7cYFqGwib8yzaeCvFJIqtIz2XtkJ/PufCUWUo2:cjt2pHYkUraDvFTIa9kJ/Pu/ro
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  modiloadertrojanxloaderuj3cloaderpersistenceratspywarestealer

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • ModiLoader Second Stage

  • Xloader payload

    rat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2