Extracted

• • Target

    5dcbf984225d5a2f42d6382630a97b57a097954925465c1369e106efb83cda0c.exe

  • Size

    1.6MB

  • MD5

    55121a01357e08afbb13cd866842160f

  • SHA1

    9baadb101bc10773b9b3b193f8f002e3b5711115

  • SHA256

    5dcbf984225d5a2f42d6382630a97b57a097954925465c1369e106efb83cda0c

  • SHA512

    ec844e64c3f756c2e4195a3d419654818dadc4b5fb678a2af6df7b6efdac4c4c0a1f56c7c3be61eea8dcc5f98e8da97e47f1e918a8e3b5fb1adc72700f5c791c

  • SSDEEP

    24576:i8tlnAd8xNapQHnIuetlVP8w9Si/6nvVlp0cYYa4Tdk4EzS65+19T:iqqqJvI88Si/SvVFnTS4Q5+1V

  Score

  10^/10

  discoverymodiloaderwarzoneratcollectioninfostealerrattrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modiloader family

    modiloader

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • ModiLoader Second Stage

  • Warzone RAT payload

    rat

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2