MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00ae65a6a1579c78baf89a99da5acabd1d5c1fb1c5e8a25f5225c46b65761240. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 00ae65a6a1579c78baf89a99da5acabd1d5c1fb1c5e8a25f5225c46b65761240
SHA3-384 hash: 80655f40704ac85abeb12643e5c02bde044e9866c686ecdf53f82f72e6ba98068317598e96524948c7b6332d17a50d3c
SHA1 hash: 6a5259376e87b3ecbebcd3cf22482207b91fff0f
MD5 hash: 56ed8b991af6ec1b5c03beea48b223fd
humanhash: magazine-queen-enemy-network
File name:56ed8b991af6ec1b5c03beea48b223fd.exe
Download: download sample
Signature ModiLoader
Create hunting rule
File size:686'272 bytes
First seen:2020-12-14 07:59:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1567a515df375bd1b383dbf78e722777 (3 x ModiLoader)
ssdeep 12288:PrnpxdtoEoVGm9a7JcJVa8eMsbGB6FOiYNmT:PF/T6Gm9gMVchO9o
TLSH 06E48E23B2A04437D1236A78DD1B97BDA82ABE003D28EC4B6BE43D4C5F75781752B197
Reporter abuse_ch
Tags:exe ModiLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
209
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
56ed8b991af6ec1b5c03beea48b223fd.exe
Verdict:
Suspicious activity
Analysis date:
2020-12-14 08:00:18 UTC
Tags:
installer
Link:
https://app.any.run/tasks/9f2ef7e3-7136-4864-995c-0d9725363eba

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/107932/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Creating a file
Launching the default Windows debugger (dwwin.exe)
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
6 / 100
Link:
https://www.joesandbox.com/analysis/561857
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/00ae65a6a1579c78baf89a99da5acabd1d5c1fb1c5e8a25f5225c46b65761240/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-12-14 08:00:07 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=acxgljvbk6ohroxytkm5uwwkxuovyh5ryxukex2sexcgwzlwcjaa._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/201214-44r2cw4k5a/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
00ae65a6a1579c78baf89a99da5acabd1d5c1fb1c5e8a25f5225c46b65761240
MD5 hash:
56ed8b991af6ec1b5c03beea48b223fd
SHA1 hash:
6a5259376e87b3ecbebcd3cf22482207b91fff0f
Link:
https://www.unpac.me/results/de20f5a9-6d41-41ee-89d0-4738925b89b9/
SH256 hash:
f670327031fea219b14cacb0874c92a24db2016f8da175093063e472c3e8cbf6
MD5 hash:
d935ff4781629f575828309fdfd10c33
SHA1 hash:
869059ed44576a9caef56538f199152b79c4e2a1
Detections:
win_dbatloader_g0
Create hunting rule
Link:
https://www.unpac.me/results/de20f5a9-6d41-41ee-89d0-4738925b89b9/
Parent samples :
00ae65a6a1579c78baf89a99da5acabd1d5c1fb1c5e8a25f5225c46b65761240
718ff9580d5cae07b3b8df0372dc9c554e5c72b55a28e68f306c47d57ac72082
5cdf035217d5c312f4c3f66b4074c9c7abd9b710c0ae1b03ec2879f3657db096
b4711ee19363ec125911ae1356714720a9d9b463848b1044d08d56977cb960db
8ede03b20c5b4ef52e213ef63d0470ed9a71caa0435a0a4bb4a6b95903cfdd76
f13d529ca2630de2bbd314359f7ac92d83acb76ff80dc169990634c1ad929b0b
556eb256ac26f32787bf8d8b54980b1ba50b93b3736683e59b26398a1f42820f
6eddee04fd3f715201359b14b2ac4c017b5c68d3059ce8cd306761fc4ee754fe
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/00ae65a6a1579c78baf89a99da5acabd1d5c1fb1c5e8a25f5225c46b65761240

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ModiLoader

Executable exe 00ae65a6a1579c78baf89a99da5acabd1d5c1fb1c5e8a25f5225c46b65761240

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/898216/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/107932/

Comments