Extracted

• • Target

    25c58bf051df8e65c188ba0ae6a183ed8e8fc129543d2c2fd0ebb511b7459327

  • Size

    769KB

  • MD5

    056c8e14391eace2a7bbce0e4fbf7fd3

  • SHA1

    8a821a498353d62a8a2f82f7dd4cb71a75469a5e

  • SHA256

    93b465d7ee036386b53254f8ba73fa8ec121b5182cc3dccc6a42426f69130be3

  • SHA512

    3d0f9b97d9fd0c1769cab13aaf325a54f124141671c8b47f9679c1754b2968b79d986d9aaa6db4daaee5844fb97adcf489a6d80c8afcc5f13f7de2500890f7b0

  • SSDEEP

    12288:Hu+e4v0ma0dwwcQNHRh+ZXiwBdbPmWNshnBMQfhxN2rn4PhWu7:HuRQq0iwcmhEffeWizhxN2rn4P

  Score

  10^/10

  modiloadertrojanformbookkmgepersistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2