Extracted

• • Target

    Ref No.72705JA.exe

  • Size

    1.0MB

  • MD5

    c37c80e84441d6e33c065c562287f831

  • SHA1

    3e3eae640ac15ad0c7163346f4b77d49248e0233

  • SHA256

    ce010315e45ac1bbd373c48807b19c342de9b486d84adbf4e3a75324c5caea04

  • SHA512

    e2ad5a912cfec1bfb906ad3a91dfe50f2759cbb26855354bd411001d653bc41da4d290e58ee333916607d4a1468e81e3a8c2824cfd6d000671453499f22bb4a3

  • SSDEEP

    24576:v6R9yfVUXwTEfF59XADz3OjaZQQJ0nhUGfApfLM:v6mO0MF59XADzejakuGfAJM

  Score

  10^/10

  formbookmodiloadernvp4persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • ModiLoader Second Stage

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2