Extracted

• • Target

    534353667789.exe

  • Size

    1.0MB

  • MD5

    04c891b9979e4852e90c8c061473058c

  • SHA1

    ab22fb90604c58e206bc3bc0c33c0b5768db6fcf

  • SHA256

    7385e28efaddf884f97be5ac178a05d5c6e523a616ba20980121005428fe3765

  • SHA512

    92f7168e7eed554938e5eb9027418734ac8898db2bada777aebc3b58e606a9bfc90cbf1234d98defe15445d9c7e5907878eaf6f1754378144b456b6c7766643e

  • SSDEEP

    24576:0it4uJtHL/PkgSAq5dRHBez6oONXEef2sS5OnYi:0iWiH7P85fsz6oM2mn/

  Score

  10^/10

  modiloadertrojanformbookao65persistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2