Extracted

• • Target

    d5b181be63ce08ec89eb7db52735a626.exe

  • Size

    841KB

  • MD5

    d5b181be63ce08ec89eb7db52735a626

  • SHA1

    c33df2f9fcd1e2b961f990bbbd819fff218c0a20

  • SHA256

    fcc333cc2afdf31c58e273f1ffe429fa7a765479582f9508867517c23d51a9f4

  • SHA512

    1cb6bb49cf683f66c7a631131797b7c6ebe9d041dd9285368ec8817c8725e88d63d6a095cc915f3dc84bf63858e73ec44318ee25d452ece5ef7759cd448071ff

  • SSDEEP

    12288:werZScSZpW3BcOfqg1EM50Pbkttml53kbXJ2zl:woUZpW3S2gKIsbZ2h

  Score

  10^/10

  modiloadertrojanformbookges9persistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2