Extracted

• • Target
    003534262416252.exe
  • Size 1023KB
  • SHA256 e54d5060f522ac4aae58c95d299bff21e5e6e014c941cd0a9e88485ea29e4ebc
  • MD5 7d8ca4eb8f29a87e50322bc202ea2d88
  • SHA1 f893bd5e1ced9a4b363a315428165dc9f8bb298d
  • SHA512 ce6285d46bcf0711f5ba89743ff50b608278796ec1a7f8f9c22a96ac82326fad11e0be58ef461a32653af3a11c8b1ccad8159c4c6063925e8d8133649a7a18ac
  • SSDEEP 12288:jRmIcCn67ZSgSZcKqe5aITzOFjHYsHlTs6EJqdvcFsymAkm4crYF+T:jR8zS0GTzA48InMvamcrYo
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  modiloadertrojanformbook3nopratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2