Extracted

• • Target
    PRODUCT.bat
  • Size 2.6MB
  • SHA256 277a01095a13bf08041d5a78c06f9f9ff32e77665e03cdd32c83ddc32a52fa59
  • MD5 82934f26cfc4b72a15289fe4055faca3
  • SHA1 1a3d048f809a5dad4ee89670b94f42cf708b199a
  • SHA512 4aeab25a0867a198cf62d1f9d611db6db91ee6c625fadcfba8516731356a6b79017eaa3c98da840a48076d05494ca389b20f4c7013f41f764c95854f2c11902f
  • SSDEEP 24576:4pMnYCoTzMBGtRfB7M0iCIvTNzaNC5+PSCgcCPdQtJdaTrtFsAzDmThQNWmeC8qr:4p0YTTz5RRm6UCmWSiIuXhY4wV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  modiloadertrojanwarzoneratinfostealerpersistencerat

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • ModiLoader Second Stage

  • Warzone RAT payload

    rat

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2