MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1fdbc93a0a891ff9ca424bb90bd696140b5918583ad6e0f2fcce012640cde8dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1fdbc93a0a891ff9ca424bb90bd696140b5918583ad6e0f2fcce012640cde8dd
SHA3-384 hash: 38044862f5dd64a1f98c857ff031736dc3c83da75a19eb53d263d41f320d4d3930922be75cf00e11a3cfb8f9b9109b67
SHA1 hash: b1ea27dab917971cea17849b482896ab3f1c9cfa
MD5 hash: 0298f54a7a0817dde314c8eca5abad05
humanhash: gee-charlie-vermont-pasta
File name:SecuriteInfo.com.Win32.TrojanX-gen.23991.29063
Download: download sample
Signature ModiLoader
Create hunting rule
File size:844'288 bytes
First seen:2022-12-01 12:52:04 UTC
Last seen:2022-12-01 13:29:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2580a9e048290fe53e8a2875b4a6750b (2 x ModiLoader)
ssdeep 12288:88xW3p8fe9EgNBWWJXVy20V0abqYU3K4j2X2Er5OxG2:8xCfe9EmLJlNIF3RXVr0G
Threatray 20'578 similar samples on MalwareBazaar
TLSH T17005AF21B1E20133C1335DB95CAAE369A429BE501D58E84B1BF43D88EE392D2FD5F167
TrID 68.5% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
27.0% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
1.4% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.3% (.SCR) Windows screen saver (13097/50/3)
0.4% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 33b0f8ba92d43093 (3 x ModiLoader, 1 x BitRAT)
Reporter SecuriteInfoCom
Tags:exe ModiLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.TrojanX-gen.23991.29063
Verdict:
Malicious activity
Analysis date:
2022-12-01 12:53:41 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c4b1a2ac-d054-4e5a-815c-143fa1d468d8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/341108/
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.23991.29063.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Сreating synchronization primitives
Creating a window
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
keylogger overlay
Link:
https://www.filescan.io/uploads/6388a3af579915b6b303cfa8/reports/fd43ca60-a051-4f8f-b769-1f5bca466266/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/09ec4ac6-06cd-495d-9467-20f54253a0ed
Result
Threat name:
DBatLoader
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1125363
Signature
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Yara detected DBatLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1fdbc93a0a891ff9ca424bb90bd696140b5918583ad6e0f2fcce012640cde8dd/
Threat name:
Win32.Packed.Convagent
Create hunting rule
Status:
Malicious
First seen:
2022-12-01 12:53:09 UTC
File Type:
PE (Exe)
Extracted files:
55
AV detection:
19 of 26 (73.08%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d7n4soqkrep7tsscjo4qxvuwcqfvsgcyhllob4x4zyasmqgn5doq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
23473106e8e2e1add3756ee0e4101095710b9663791f57e026e08f99218077ff
ModiLoader
2cb0d3b3c2a398a778d18b089cf68d8f7fd91808da695bee0f0fb556354efe09
ModiLoader
7a9c39d98ace102b6fa94aafaa6bd652b17b247da09bee12e84fca6302b08e19
ModiLoader
d1798c288b296009d8049ca5364b29b079d59fadc870af65e92fe5fa23bdcec5
ModiLoader
e25899bad9933c1b9676b0f94e0ef4f2be4756ae298e737f3dc67fea2246e8f8
ModiLoader
ebb76e46e178491fd48787e80ce952910124d6f1a00c92744a5f84278192030c
ModiLoader
f6ddc63173d134db79db880c7f5b338987f31ddd36cfcb27cf15e3bb08a507bb
ModiLoader
facf2fbbac21edd7550d00e6f6916f9ee598f9c3bdc2ca0feb288c139d687672
ModiLoader
fadd1059ba6d602427a8d00daf8e93b283ec5fbc8180ce65fc246ebbb4ef7318
ModiLoader
+ 20'568 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:modiloader campaign:t3c9 persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/221201-p35n8ahg37/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetThreadContext
Adds Run key to start application
Reads user/profile data of web browsers
Formbook payload
ModiLoader Second Stage
Formbook
ModiLoader, DBatLoader
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d1b744a4-c78f-4c84-9a4d-91c753a732c1
Unpacked files
SH256 hash:
5c90e87df09275cfcb46e0452d77e149f3fbc59d55bda76e62e6fa11ae1de693
MD5 hash:
ee94f46ed9b387ad243c36c1cb062686
SHA1 hash:
6e0c4dc795dec2dce9454fbb246afabffd2039fc
Detections:
win_dbatloader_g1
Create hunting rule
Link:
https://www.unpac.me/results/996cb62e-f3e9-4fc9-a624-097e31811add/
Parent samples :
4ef967caea627a1b9cd7f74d31584b69d76f8c532cee528e8815c4f70ae24aa7
dc35d3d87c8f062b000472a46ec166c5bf8f399f95c02717eab4ce542043afd7
bb01ebad742a61a5aee09777d88a01e627d29171513c335f52c57c41c7e41ef4
0dec26f0ed31eafa41f5141a4342f84f5245ba6d097904ed1fdb11a6df1ce606
c2c6eec67a1561c3a49179ddf756480876d92588c2e83d64246a04c3d724cb3d
f53107b892a50e33ff130e01cf391a2b69524dbe09b75cc13192365bbd6eda11
9c9b7deb6e3b6b7154fb858a101eb57d65b57e364840213823ce5c8e0be1653e
109ab3837f865b4ba288ca4a1fa4e8d416c04b3686376c55128553d4a4db55b5
1fdbc93a0a891ff9ca424bb90bd696140b5918583ad6e0f2fcce012640cde8dd
230b07866371131de12907f26f06a9cfa27762c499f93cae840c198ea9e46846
494e56903190304bab1c27786bd1f60aeaede9b478b2bca17474602414b82688
db399100d63fa87dbc5d6596d2c44749c0cee86ea45d7e81206277c9cdacb9f1
16ba74e590acbf2a285ae1e15864ef7cdeff576542f0f430ab83481ea52b729a
ffa9f3d0e3d4d29b10cba30fe3394d538b8c415e9c29cf36a56990e9204ec7bf
0305b3a95aff122c888a200de747a565208ea19494c8257b0c972084141f42c4
c84d9cb4b4e037cbaf9632d4cdd0f493d2c5e0b5f6308fe97f84f04b501155c8
a9da7b242be8ba00f35c48183b953f5e792c948a57ed1043f6759a5b61f19d70
e7298f63b0ee46b470e6c7323087e2af9fe4802ed93674d1408f10d03989a7f6
e6303d0730eaecd16e8a3becf77fce3d5da13155d2e27e102ecc2b700ad42814
105ffb0a1b83441a798498a4b1a535fce7f496304b39bd555f18df3678f19c13
ca13eac154ad479e2234deac0f07989db25e4d50c47cdc7f4f31dd7ab71dc087
03daa8dcea75f814b344785dc1f52222cd4461bccc17a35f032efe81e47d18be
6246a9212db799df597fe34bcbeeeb08dad116b7cf3cd4c8037d42d1d0b4256a
aaa28e71ec8aad860fdc9f517c151b85be433e142160341f2aa399d9c60d11cf
f974cf4bda9a65b7a2573726e3808c696f6a5e54b89f08807764d9ab2a06a5c1
b8002e076820615fe2b14369e7d258ff2984cd832a38de4f1450b84813b283c5
de8c5c01bab7e747f3cd3f276d7cf3c839600131987cbcfcd5314f9af6d64b05
7cec52ddbd0c2037de1b4ad9eedcbedbfc005cb558c7f326dcf66c800e7875f1
91dd17921c69af057a78759611885bb04ebc68a9ec38ca08067c496f9e76a241
b0d85d76e52034986c3d4e165a745c04b3af21d1c5692719d1b66bceafc76423
af5ecbd67c2195a72178b6b0a886715d4b28fd064717dd3193a477563c5be6b6
7a91675248e7d9891570e731b1dce694054d9db90f14bb4a74d5a9fd571af758
878257b5d411ceedf80fcab13183bd22ea6183a86c8d5a99a7ff08dd01567fc0
c4cd277e81aec420cdf23a0d5ebff50b0d64dd9c6b3b1942567c263032f64deb
SH256 hash:
1fdbc93a0a891ff9ca424bb90bd696140b5918583ad6e0f2fcce012640cde8dd
MD5 hash:
0298f54a7a0817dde314c8eca5abad05
SHA1 hash:
b1ea27dab917971cea17849b482896ab3f1c9cfa
Detections:
DbatLoaderStage1
Create hunting rule
Link:
https://www.unpac.me/results/996cb62e-f3e9-4fc9-a624-097e31811add/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.27
Link:
https://yomi.yoroi.company/submissions/1fdbc93a0a891ff9ca424bb90bd696140b5918583ad6e0f2fcce012640cde8dd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/341108/

Comments