Extracted

• • Target

    c1d948fee0541e31cfa3affa9d99a6ad6cf287601f3ddae9238c3ca379a4686c.exe

  • Size

    957KB

  • MD5

    2ebf7f5b65c0e71bf0f36e8e9bbde1c3

  • SHA1

    94f3d18e57d6483c03cae67478bb559a2e3ae0f8

  • SHA256

    c1d948fee0541e31cfa3affa9d99a6ad6cf287601f3ddae9238c3ca379a4686c

  • SHA512

    e5ff1f5b652b2f16f225bf465bbee6340560d75b7e5e8460afab86db23ec1989faa9f5fe1f182c047ba7a9dcbfcd7a299fa3b0103786f279b48bc20d1100b59b

  • SSDEEP

    12288:0nONo4ehvLMuotC0NgicDPP2sBJ79D67KI04YCE+PhcimEwz8dQNHTcFpI2qjS:0nOPeFGhgicDnDRZBCEMcihwId+jT

  Score

  10^/10

  modiloadertrojanformbookbs92persistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2