Extracted

• • Target

    Modulo di rimborso 202400070804892.cmd

  • Size

    4.5MB

  • MD5

    9fd629694c754e95e3d3d6901714cf45

  • SHA1

    f2fc18feaba20e3468c9d32982a1d5403b25c960

  • SHA256

    c2913976f403d03823ed4c83991261389f4ffbd4aa7295130bf8be34f5c65bc6

  • SHA512

    ae55a35eb865bc0744e37477bb32c3e7e4fada03eb1ca99e05d8974337ecd1ed37a4e90f5b1d833be6ae70f23c2f3d3e54d3fe4fcca1dcdedf476e226b9cf7f5

  • SSDEEP

    24576:3ooFjC7vlHPGkNpzz8Psv4Tycq8Yhns9Sfu6ZkvMJkUiSSX+HPd0BxBJGhRCbjt8:3ooF+7vZ+aB8PsKQdfwn94ojt08qv

  Score

  10^/10

  lokibotmodiloadercollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • ModiLoader Second Stage

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2