Extracted

• • Target

    53506f1598a87e624f80a10d0.exe

  • Size

    746KB

  • MD5

    ef6def73818ea13b53861bd8a9f8b864

  • SHA1

    8336b65aef30e0e1ea91c534fa430f128a910a2e

  • SHA256

    53506f1598a87e624f80a10d0b9db99790fe3252ae647c334d1957ef0d07721d

  • SHA512

    bd9b6a3470d97ea8b47d9057ceb593059102c5304952595294b199228ef4566016e554862543d3e3b21d90efe3f251b56065f8228a9983a79de27dc08a8f29a3

  • SSDEEP

    12288:3GR+Vd0ckynvLwdJgNsycuL573BhZWPNFWrsEL09pmHtJNNW/8kUPQ:3GAVk4Mwom77WGrs9StJNSUP

  Score

  10^/10

  modiloadertrojanformbookt3c9persistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2