Extracted

• • Target

    Yeni sifaris siyahisi.exe

  • Size

    714KB

  • MD5

    6172cb3957b8d2e9c6826b552ce3639d

  • SHA1

    4baef093ea515002536b9de941b4a6df8d7a28a6

  • SHA256

    5839da1f2d15ad51aa8165869552f628e67bb3e30341ea9f619a1167301e8354

  • SHA512

    1b08fb6e0bde7d5b2336ec2dd12e7559f70d8ed6e5798432bd01d6efb91d4e74c144d2a6a45cf8d743b6c77a4e360475a368cf2aa180cc61c65ce89e8cc154d6

  • SSDEEP

    12288:D4iyBJSbLJfaMAhJVNRdfNl6lFqZLDZGqtV2ZE:D3ykf9AJ5vcADHW

  Score

  10^/10

  modiloadertrojanformbookxloaderuj3cloaderpersistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • ModiLoader Second Stage

  • Xloader payload

    rat

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2