Extracted

• • Target

    Order confirmation, Invoice.exe

  • Size

    1.8MB

  • MD5

    08be0b23f7706fcfddf96ae258a67249

  • SHA1

    54b9491995dda5b4849c5f10afc53175e0f67bd9

  • SHA256

    66c7d769249d9da750ff736b447f0573c7cd5432a680e3a72d09bc1e238e83d1

  • SHA512

    716a7751942e38f097c881bed9e6389043ed6360ca3f1dd65dd7ae644f6967ecaa9a9445295c31ac9d7e58ec316672d6b1c3b165a0473c8da2b276dfb2239a44

  • SSDEEP

    49152:aD4+yRMXpcOX8IxTqh0eJa3DZEe9sRuCVCW4FMyqChsyfue9T:aDqRMXpcOXX8Za31CuCchMXC+yf

  Score

  10^/10

  modiloadertrojanformbookao65persistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2