Extracted

• • Target

    new purchase order21125.exe

  • Size

    1.8MB

  • MD5

    b9c0d10552c058aeadef95a0cab3755c

  • SHA1

    f72f59c9c9e9bf1494ef92db4c13f7eb5625c142

  • SHA256

    df80f759e36eaaf7267e2dfa07ea02d3b5ee82f5ad88aaaa0496a7fa4db48e39

  • SHA512

    127256f5d8699e639194e76f5770333180402d169ccc53965b2cba6c2aa12392c3638e73823df78178e3922dd388fb9d347bafd8b65ba27b1b406976c71bae26

  • SSDEEP

    24576:Njc1TK7Gs05bZbtYXekG4+BiKr8ZHu0UZtouSBGSOaH+Au0UZtouSBGSOaH+n:NlLOkG8Q0wsGmHa0wsGmHu

  Score

  10^/10

  discoverymodiloadersnakekeyloggerkeyloggerpersistencestealertrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modiloader family

    modiloader

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • ModiLoader Second Stage

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2