Extracted

• • Target
    ordine PO_8791121-964-29 pdf.exe
  • Size 936KB
  • SHA256 dac4faa0ae9110acaed3d4890a20d2600d11d040386f40603891aa0880fe825d
  • MD5 d4f54a68391f5be34e03eeb7539943d2
  • SHA1 4186cb810a6d08fb7436b1c294d2c2d8b6f59ab0
  • SHA512 b148372b93982fd9dfa08ccb9690f378f9d009c9caffb5b637ba18dfa95a9e07588cf8e11f96c83ae7400de7a0cd750b1a1184224fc4780acbbc1386fef21f32
  • SSDEEP 12288:+QBzavIzVsaYnU73sX1uyth/ZAknhZCoxWapgv09PzDVPSO+Lb4Kv:+QBmqsaY2iuA/jav09PNPr+oK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  modiloadertrojanwarzoneratcollectioninfostealerpersistencerat

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • ModiLoader Second Stage

  • Warzone RAT payload

    rat

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2