Extracted

• • Target

    TheWarz-Crack.exe

  • Size

    1.2MB

  • MD5

    6b035800be70ccbedd9154a9ae57d03b

  • SHA1

    c7de2eba384c891723b4a17753ee00129f5fe973

  • SHA256

    e621a036413f70d0a00dbe48de5773dceea1429dc1864aebe90cb277583690de

  • SHA512

    1b41dc9bf8c040ca33d26da8986f346ff6be02bf2197b78c96b2c6dbb45ba19bf4b31d8eeb4e715c78507b78ea6d2b05d039fb28e11ec8750fc5080a42c318d7

  • SSDEEP

    24576:yzjh/FIFRPOUS01XpN4wEpv7I+CqSfhvuwGHEqPb2LxBxf3y:CKFNSEpN4NpvcAyBudHTCFq

  Score

  10^/10

  modiloadernjratthewarz-crack-1evasionpersistencetrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • ModiLoader Second Stage

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2