Extracted

• • Target
    HBL - TPLINNYC20220211 - ZET MFG -.exe
  • Size 939KB
  • SHA256 b90122d45b3e426cdf4343cc47fd486e67d4d2fe861f6a686f4d29919a327ed3
  • MD5 3b94fdc5e66e0366ea3fe045413e27d3
  • SHA1 8895637c0016e15baa66a60d0066a81c38a09213
  • SHA512 031e8977655d3120b23800c43b53d5133b5efa9ab2fa5913d7662c7fa5e2723db08ca10b4981f73b9451b93b8aa212a7f28e6be633b97b395bc3a004ff6c419e
  • MD5 SHA1 SHA512

  Score

  10^/10

  modiloaderxloaderk9soloaderpersistencerattrojansuricata

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2