Extracted

• • Target

    Yglwulsvxiiswr.exe

  • Size

    1.1MB

  • MD5

    7f11fbaa2959fa9da839e42e2e52619a

  • SHA1

    06b5a1c77c5965950b2b2cccfad6bad9b7579d53

  • SHA256

    ac00251b8ba5b7bd219bb23bb5134a11f1215d19aaa0915e5a00d7906906b19a

  • SHA512

    92f67ba06e05949870c7aa5f4144125a466d8ea604b116729133a18b287c3d44e584b0091543e04bc8f0fc399754f4a723d08522484390bf2a626cab275421b1

  • SSDEEP

    24576:1RxK0h0gJ+HYS9XsILx0P83H5M8OG31WYm3:1RN+Hm3

  Score

  10^/10

  modiloadertrojanformbookfadcpersistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2