Extracted

• • Target

    14020611jpg.exe

  • Size

    1.8MB

  • MD5

    51b9ff03237be0d2b963cecee17844dc

  • SHA1

    821a54aa0fd28336d98bca841a41f6b5e8faee76

  • SHA256

    2335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2

  • SHA512

    e1a5eaddc4aa1bc2e1b133f939049f2fbbb37f4f086b499df06f96ad672ed974c87f70180e793838a1665de3244c02c4925f423a248ccb39d89fbe174765538b

  • SSDEEP

    49152:aD4+yRMXpcOX8IxTqh0eJa3DZEe9sRuCVCW4eMyqChsyfue9T:aDqRMXpcOXX8Za31CuCciMXC+yf

  Score

  10^/10

  modiloadertrojanformbookkmgepersistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2