MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0567b86ec1e2be772943f8d57bba0d17f24ffb9f6b99ecb1214e74a27bbfe568. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0567b86ec1e2be772943f8d57bba0d17f24ffb9f6b99ecb1214e74a27bbfe568
SHA3-384 hash: e9d85f796414745f8d15e79ddc6969cb4f9c126fca3144108ff597a53824691dfa49d2395091c11552762ad33c94c67c
SHA1 hash: 06ed779b22c11f692fb00887cfc23f14d228459d
MD5 hash: 273b38ade13110bd4c7675c70b85b422
humanhash: hot-nineteen-lamp-virginia
File name:Rtyhsbb.exe
Download: download sample
Signature ModiLoader
Create hunting rule
File size:864'256 bytes
First seen:2020-10-20 08:57:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9d99d2b7dc0b1c0b642d9d88933e0dd9 (8 x ModiLoader, 1 x RemcosRAT)
ssdeep 12288:Gg6qVpf8BGuCG43fxR8bUQFqSjRJsK/Al/4fMCGOLou:GgZoBGuX44pbLml/Dpw
Threatray 1'760 similar samples on MalwareBazaar
TLSH 9D059E63B2918837C0731A79DD0BAB685D39FE007D20A4463BFC2D4D9F79641787A2A7
Reporter abuse_ch
Tags:exe ModiLoader


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: smtp.idsbangladesh.net.bd
Sending IP: 117.103.80.91
From: Linda Silva<cgjapan3@super.net.pk>
Reply-To: <2215548993@qq.com>
Subject: Re: Swift Copy
Attachment: Rtyhsbb.rar (contains "Rtyhsbb.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/73440/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Creating a file
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/497454
Signature
Allocates memory in foreign processes
Binary contains a suspicious time stamp
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Writes to foreign memory regions
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0567b86ec1e2be772943f8d57bba0d17f24ffb9f6b99ecb1214e74a27bbfe568/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 08:42:49 UTC
File Type:
PE (Exe)
Extracted files:
45
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=avt3q3wb4k7hokkd7dkxxoqnc7ze7647nom6zmjbjz2ke6574vua._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
199528b69b42d1af70f525973be5e53bcd16c19b39a117cfaa27ba1a515723f8
ModiLoader
3b97909b8cc676b840fd25680d29f211efcc6c71a0234f33365dd0fec17e8438
ModiLoader
5434b3121b379bde98f409a5d00c6da0be9f001b73e73860ca0c530386e002c6
ModiLoader
58bd9279e5ef2a3c1a55c9257c276f8203b69c79e29008399c6629eaf8ca6d56
ModiLoader
6490275833a54ddb21377ef003cacd595697c7659c1b7c6fc24a285fec1946ee
ModiLoader
7f0424ffbe5b0d339a9164c0417ede65b33ec131a6b7f178102a6384640ee1eb
ModiLoader
8867e72aaf3985ed148d3049c628d73ba0024e3129e466c17bd6a665be9e84f0
ModiLoader
96ff361eeb8ab440652d1cbb8b28146f8dd9ee8cf9885f84ff4592b2551da57f
ModiLoader
f5744fe38455554d445847e8dd1794570176bab8fc9b56f9bdd9406a59010a7e
ModiLoader
f94e8615fb3b739ab3ad8ec81511b5439a72d4e865a5f9975aa524ac6036d3c2
ModiLoader
+ 1'750 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
spyware trojan stealer family:lokibot family:modiloader
Link:
https://tria.ge/reports/201020-jyxmcb7v1s/
Behaviour
Modifies system certificate store
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
ModiLoader First Stage
ModiLoader Second Stage
Lokibot
ModiLoader, DBatLoader
Malware Config
C2 Extraction:
http://marshs.info/sun/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
0567b86ec1e2be772943f8d57bba0d17f24ffb9f6b99ecb1214e74a27bbfe568
MD5 hash:
273b38ade13110bd4c7675c70b85b422
SHA1 hash:
06ed779b22c11f692fb00887cfc23f14d228459d
Link:
https://www.unpac.me/results/032c7a9f-00bb-4212-8748-0912315ca906/
SH256 hash:
09d882b9f2ee1b1c4e741148bff6022ad2dc954336f4a0068e74ac44b8c0da90
MD5 hash:
2d396f6b17ced0f5bbe35732b059f39a
SHA1 hash:
f99451819cad0af6dc99df27d3c59ac47c50a2ec
Link:
https://www.unpac.me/results/032c7a9f-00bb-4212-8748-0912315ca906/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0567b86ec1e2be772943f8d57bba0d17f24ffb9f6b99ecb1214e74a27bbfe568

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

rar 0e63080a7206e75448f1d4ce954b338eb41769dec32c2786b29ccaede1c2dd71

ModiLoader

Executable exe 0567b86ec1e2be772943f8d57bba0d17f24ffb9f6b99ecb1214e74a27bbfe568

(this sample)

  
Dropped by
MD5 36ce02d7b9c83fdb325c1b6a21388ce3
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/73440/
  
Dropped by
SHA256 0e63080a7206e75448f1d4ce954b338eb41769dec32c2786b29ccaede1c2dd71

Comments