Extracted

• • Target
    54335453425234.exe
  • Size 57KB
  • SHA256 002a55a722eb437d66039df4b8e16b32baa59ba4f3a180c0d5a0514e01dc7377
  • MD5 3db6691099ca8a85cb08e68dc8eed38a
  • SHA1 9592497a91fd06c82e0082c61ebff8688b4932dc
  • SHA512 ba0778c135da545a10cfeea230263493d2339e19b61d2a9a2db93f805a620a79381c2d6be82ee1ff199b4bb490013e624b2d68e937966615c6ea64a67c6cb60e
  • SSDEEP 1536:JiNNpIaOeW6fBnwL36ZOR8Rngkb/kiqnLx3oXyDmOJHLFu/:MNNpzW6fBwL6/gkb/O6lOJk/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  modiloaderxwormpersistencerattrojanupx

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • ModiLoader Second Stage

  • Drops startup file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1