Extracted

• • Target

    RFQ project UzMTO (Uzbekistan).exe

  • Size

    882KB

  • MD5

    737378c901a202e36a7cf0496c40becf

  • SHA1

    8409b35c0c7ee39b7cd68f7471bb6d9373648379

  • SHA256

    2a62b0901586adcfed9a57c10d5cdd13b53db183d52c9e3ab296df05d634b146

  • SHA512

    a79dbb6bba8878dfc22fe4d907ddb39dad848bd5e836400847c21312630ba445d93840da6b858a617e37fb3421bf79cfcbb4c1984d108b0f2b82870f6d7985f6

  • SSDEEP

    12288:zBTU8A8RppNfqVu3TZLt78lFC927150Pbkttml5OHN6dPfh:zJ8+fNfVTZOlFbsKImHQdn

  Score

  10^/10

  modiloadertrojanwarzoneratcollectioninfostealerpersistencerat

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • ModiLoader Second Stage

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2