Extracted

• • Target

    b5940caa2bb500680f0fee56d5d09de0.exe

  • Size

    703KB

  • MD5

    b5940caa2bb500680f0fee56d5d09de0

  • SHA1

    c8794e4ddb4e26c3459bc971d8ed602f2d3f3886

  • SHA256

    55b7f1bd4c56855427d9f9cec42bc93f75995193f023f4242b7f6e958868f619

  • SHA512

    ec3b0fcf8fc00ff05e35d456eaea8cf92706cc5bba3f0604c847b516ceca2c107ff46d2d6d74a3bfd37df26e686c561a4a29e8e9c23d5d4480715342227fc5e9

  • SSDEEP

    12288:gkI303av+MZO0bfKIosoFwewOPyaEzjOol:gkGv+MZOxpFLwOaaEvO

  Score

  10^/10

  modiloadertrojanwarzoneratcollectioninfostealerpersistencerat

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • ModiLoader Second Stage

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2