Extracted

• • Target

    95c4b78aa2574cc094f0ab1ca7fac7b2adef8123aab82680c1a88df43f5a282e_JC.exe

  • Size

    1.2MB

  • MD5

    a10cf8a3681ab6cecbef571277db46b8

  • SHA1

    d36ec11ce08c30f172a76e64e4c9e1c05adf5951

  • SHA256

    95c4b78aa2574cc094f0ab1ca7fac7b2adef8123aab82680c1a88df43f5a282e

  • SHA512

    fa843579cc7833276ec9fc534f25b618166601ab9482203beac35c3eac1ec5db0e38dcc5925896a1c7ea63db92d56f7a3ca2a858880b4dfeac00be0e44766c23

  • SSDEEP

    12288:dN7i6PeBQ9p1nU+Ji+/F1u1mlNHbsgyAvBvvc+X2B+d4ELSQZBLLKbIt383739Dc:d5i6lnUr+fuMpNDJ2UxtkRN0D9v1

  Score

  10^/10

  modiloadertrojanwarzoneratinfostealerrat

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • ModiLoader Second Stage

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2