Extracted

• • Target

    07ca371727b256539e6316faebc1b9d671bd4be195082e4e3db38e5e2d396194.exe

  • Size

    754KB

  • MD5

    d2a4fd38881cf31c8c57a6d0b5ff7efe

  • SHA1

    8d50451c1af8f540f08e9ad9dc9c82f28e12fd39

  • SHA256

    07ca371727b256539e6316faebc1b9d671bd4be195082e4e3db38e5e2d396194

  • SHA512

    519b8e506c285a6c3f941c9fe95371be8e940c405a5ac16e6d3ea7e76a9d69a930de9aa77910a5030dadf552ed3a8e4ba5b0760f9cc7285abe3e0325993d4523

  • SSDEEP

    12288:tVxfM/PNmfig4qXnWy1ZsY2mTS7gazVb8N0K1WqLjPjAj:/iEfB4Q9+VIEWjPi

  Score

  10^/10

  modiloadertrojanwarzoneratinfostealerpersistencerat

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • ModiLoader Second Stage

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2