Extracted

• • Target

    211BB570BD70A89E4680D34451DD3350.exe

  • Size

    908KB

  • MD5

    211bb570bd70a89e4680d34451dd3350

  • SHA1

    da743c57a2b1727e3da7cdf8e98b9cba93ecb862

  • SHA256

    cd26009a2cfa0a5f8b8e44786b045b4a0d8faf78ae5ae044a64226f3ced2bda7

  • SHA512

    da76993cf60de3d5edea9de33972409c689eaeb82c2c1afde3fbf4e5b79a2ab476caf127c1999be6b281e31bb7f9f1fe041fdc1e3882a532723dfb7bcd0b3e4d

  • SSDEEP

    24576:xgLzNa28Rcr2O86+6MDUlnEXYfWGOvD7QKM:xgL4HA2/KrJ

  Score

  10^/10

  modiloadertrojanwarzoneratinfostealerpersistencerat

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • ModiLoader Second Stage

  • Warzone RAT payload

    rat

  • Adds Run key to start application

    persistence
  behavioral1behavioral2