Extracted

• • Target

    2b05890fb7420b28f7bf26724.exe

  • Size

    762KB

  • MD5

    177ed09e1d8216f87a593057ec413a52

  • SHA1

    1cec954b01bcd3fc8e9e35f0d07dc49c1fcb9853

  • SHA256

    2b05890fb7420b28f7bf26724e58d2ae4a09c9cd9b1020d2bbe42d03ac4b35f8

  • SHA512

    44f92f848c1eae04cc0dfe2452a5dadd6293cfde9b8c742c612c839f4970e1b463bb27549ce6ccc32341aa9ef093861c0b39b0bb25c7d07e54bd3206058e950e

  • SSDEEP

    12288:VPRdmMlUOv2nhg+kX0WmSJXkP4x5MlnXkr:VJddU7nS+FJSiPGMlnXk

  Score

  10^/10

  modiloadertrojanformbooknvp4persistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • ModiLoader Second Stage

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2