Extracted

• • Target

    PAYMENTADICE565OUTBOUNDex.exe

  • Size

    948KB

  • MD5

    268ad9d551b4173c3bfd39eef6ad76b9

  • SHA1

    6ca84e053936508354a7805f36b1fd7e25f6970e

  • SHA256

    a08cd110a928227dd4b3b42b1801bc1c907dd042bea8494ac701142c5eb345da

  • SHA512

    03f5fd63552e49d6fb2ad05596429fb2352c7384d084da7f45df04cf70eb4886d77871cb7f4321f65b62c1ec18d232ed372046d609ae559b303bd941c5567ef9

  • SSDEEP

    12288:5DQy2c+bp9/95hiFFCt2AvQBPNIkry/wNQZqLfLYUj2Msx2AWwoo+5dHg:5cnbp9mIzvQBa1/wNQULfLYUyVxHjohM

  Score

  10^/10

  modiloadertrojanwarzoneratinfostealerpersistencerat

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • ModiLoader Second Stage

  • Warzone RAT payload

    rat

  • Adds Run key to start application

    persistence
  behavioral1behavioral2