Extracted

• • Target

    ada756ec2548385ff32dc61314fcfcfa.exe

  • Size

    841KB

  • MD5

    ada756ec2548385ff32dc61314fcfcfa

  • SHA1

    df8fad46b3249e3a993bf55e382300d308f356ff

  • SHA256

    462f7def88d586fd3668cbcb9e4b7fe76be5d683dc45206da81f61ad270b1405

  • SHA512

    9abd31148f889a5976ed7c1004827c577a5ad2a35dbe0c989acd9900e6a8405c7b7e156df7e704ce8dcec43f78640f45eda883290eac5582232a6f45d846769d

  • SSDEEP

    12288:IEaSIJxsS4ISFSs417nXbaGBazVb8N0K1WqF:/F0mcSFS77LaG6VIE4

  Score

  10^/10

  modiloadertrojanformbookt3c9persistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2