MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e7e018ee5838bf8450f343923ba4ce6c1282ed1b727fc4ab5cbe69b6204fca2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e7e018ee5838bf8450f343923ba4ce6c1282ed1b727fc4ab5cbe69b6204fca2
SHA3-384 hash: b29b283f60ba58fd6a23bacb9cdc8ce23233b89774d67a6a2bd3b3b9c075035fadc54f23666d0de1a26623960916bbac
SHA1 hash: a2b827f3b066c3104b0bccf3d7aec3be95bc332f
MD5 hash: fcbad6746ff9491091551b5233a5ac2c
humanhash: skylark-lactose-december-eight
File name:fcbad6746ff9491091551b5233a5ac2c.exe
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'066'176 bytes
First seen:2020-12-09 10:24:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b533f6ccb714ea0a0f83e1cff60dbfe0 (8 x ModiLoader, 2 x RemcosRAT)
ssdeep 24576:eklbZpRNhPXNH/yLjaKuOflQAE7D/cX+2hu0aU:ekhRXNNKuOtQX/2vhuxU
Threatray 3'160 similar samples on MalwareBazaar
TLSH 8E35BFE3F5E0453EF1360570DD0795B56824EE182E9EA84626BE2F0D0F786C7381B99B
Reporter abuse_ch
Tags:exe ModiLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
fcbad6746ff9491091551b5233a5ac2c.exe
Verdict:
Malicious activity
Analysis date:
2020-12-09 10:42:58 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e440c9d9-c3c1-4c55-a102-687b59f14fef

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/107415/
Detection(s):
SecuriteInfo.com.Mal.Generic-S.19006.16952.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Creating a file
Unauthorized injection to a recently created process
Launching a process
Launching cmd.exe command interpreter
Sending an HTTP GET request
Forced shutdown of a system process
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/558849
Signature
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 328521 Sample: uqAU5Vneod.exe Startdate: 09/12/2020 Architecture: WINDOWS Score: 96 29 g.msn.com 2->29 41 Malicious sample detected (through community Yara rule) 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 Yara detected FormBook 2->45 11 uqAU5Vneod.exe 14 2->11         started        signatures3 process4 dnsIp5 37 discord.com 162.159.128.233, 443, 49719 CLOUDFLARENETUS United States 11->37 39 cdn.discordapp.com 162.159.130.233, 443, 49720 CLOUDFLARENETUS United States 11->39 55 Tries to detect virtualization through RDTSC time measurements 11->55 57 Injects a PE file into a foreign processes 11->57 15 uqAU5Vneod.exe 11->15         started        signatures6 process7 signatures8 59 Modifies the context of a thread in another process (thread injection) 15->59 61 Maps a DLL or memory area into another process 15->61 63 Sample uses process hollowing technique 15->63 65 Queues an APC in another process (thread injection) 15->65 18 explorer.exe 15->18 injected process9 dnsIp10 31 www.marcomarabiamea.com 107.189.2.52, 49765, 80 PONYNETUS United States 18->31 33 www.jajaten.com 154.203.159.213, 49734, 49769, 80 HKMTC-AS-APHONGKONGMegalayerTechnologyCoLimitedHK Seychelles 18->33 35 26 other IPs or domains 18->35 47 System process connects to network (likely due to code injection or exploit) 18->47 22 control.exe 18->22         started        signatures11 process12 signatures13 49 Modifies the context of a thread in another process (thread injection) 22->49 51 Maps a DLL or memory area into another process 22->51 53 Tries to detect virtualization through RDTSC time measurements 22->53 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e7e018ee5838bf8450f343923ba4ce6c1282ed1b727fc4ab5cbe69b6204fca2/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-12-09 10:25:08 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fz7addxfqof7qripgq4shosm43asqlwrw4t7ysvvzptjwyqe7sra._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
netwirerc
Create hunting rule
Similar samples:
17c7eb5988e11440ac66fccc2a9c8ada3ab1e7183480ddd05ee3a47b19a95f9b
ModiLoader
2664162d0341d8e5cf1cf3a290b77406d87111e3c9ff3fcf3a4f0836d15d3afe
ModiLoader
2919a5d96ade5e0f2967d98a7b49b1f612435ed6a6b3843424a8c1e99ea0e9ab
ModiLoader
29c9884d02cba2c6ab0a72af878c9f1c2768d96b912f5847608fc040f5f98083
ModiLoader
6d923f02c2252e4a2ea98a8685fc5237354e2853791855f1a451a390dd85cbb9
ModiLoader
9166caa8818f4cc62ac7922d901d396e17c0ff0867c48d52bd891b05121abafd
ModiLoader
9a176cf24fa09ec01bb6e51507849fa8aad355bb25eba73ce43f63579997633a
ModiLoader
bea787acfc0effd615ab72ab1be2d18bb7b1eb07bed15b013bdbbf3c61b5fd86
ModiLoader
cf881c52980129f685da1dee4674018fa0fc1db346565dd917ae0160ce26b25d
ModiLoader
d0743e20f8ddf388b214bd59e11b36f000b423350c56c065133d533af64b4a00
ModiLoader
+ 3'150 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201209-tsggt7gh3x/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
2e7e018ee5838bf8450f343923ba4ce6c1282ed1b727fc4ab5cbe69b6204fca2
MD5 hash:
fcbad6746ff9491091551b5233a5ac2c
SHA1 hash:
a2b827f3b066c3104b0bccf3d7aec3be95bc332f
Link:
https://www.unpac.me/results/7af12f2e-b5f9-4a99-817b-fb67d6ecc49e/
SH256 hash:
76f1ec2540b91b493433a842e856fe4ba8bc24a8f783c73f3d73e25b285d26fc
MD5 hash:
e46ccd8e0723a40f5ca23b745ca9dd35
SHA1 hash:
37265fd19d00fc0abcf10296689bcee51475a1a2
Link:
https://www.unpac.me/results/7af12f2e-b5f9-4a99-817b-fb67d6ecc49e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/2e7e018ee5838bf8450f343923ba4ce6c1282ed1b727fc4ab5cbe69b6204fca2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ModiLoader

Executable exe 2e7e018ee5838bf8450f343923ba4ce6c1282ed1b727fc4ab5cbe69b6204fca2

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/107415/
  
URLhaus
https://urlhaus.abuse.ch/url/898216/
  
Delivery method
Distributed via web download

Comments