MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33e6263b0e9dbd16c509e5701a60e4615feda4713fad24c75f51c94e5e53f5cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 33e6263b0e9dbd16c509e5701a60e4615feda4713fad24c75f51c94e5e53f5cb
SHA3-384 hash: de6b87c7890558a22452b1b6e177dc9920ddf3775b4cadc80aac8d8f459202dedb425f007c9c724c47c2c9f64d51b7e8
SHA1 hash: 7289217e59872deb50a8bd788038e8551959c3e2
MD5 hash: a0e2bb70814ce5319f6a5a5ffb1e21e4
humanhash: virginia-oranges-black-robert
File name:DHL_746361.exe
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'050'776 bytes
First seen:2020-10-16 13:02:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a31ea16644ced8e431e2fe203a7b0361 (15 x ModiLoader, 4 x Loki, 1 x RemcosRAT)
ssdeep 24576:9FT7lBs40jT0sUbtpW/nAOPq3Sp586n7nLT6USE/7LYUx5t8SH1V:9vBsxTEi5X7nLT6USE/7kUPtF
Threatray 1'076 similar samples on MalwareBazaar
TLSH 6425CF31F3E1CA36F2571531CC2B5BA9A532BE002A24945A76E63C4D9E367F079392D3
Reporter abuse_ch
Tags:DHL exe ModiLoader


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: jovial-wilbur.52-162-254-219.plesk.page
Sending IP: 23.96.201.44
From: DHL <support@dhl.com>
Subject: Your AWB Shipment Has Arrived
Attachment: DHL_746361.IMG (contains "DHL_746361.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/72035/
Detection(s):
SecuriteInfo.com.Artemis5F81083596A0.8651.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Creating a file
Launching a process
Running batch commands
Creating a process with a hidden window
Creating a file in the %AppData% subdirectories
Deleting a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Setting a global event handler for the keyboard
Sending a TCP request to an infection source
Unauthorized injection to a system process
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/493655
Signature
Allocates memory in foreign processes
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Creates a thread in another existing process (thread injection)
Detected Remcos RAT
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 299285 Sample: DHL_746361.exe Startdate: 16/10/2020 Architecture: WINDOWS Score: 100 48 Multi AV Scanner detection for domain / URL 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 Multi AV Scanner detection for submitted file 2->52 54 8 other signatures 2->54 8 DHL_746361.exe 1 15 2->8         started        13 Bkppdrv.exe 13 2->13         started        15 Bkppdrv.exe 13 2->15         started        process3 dnsIp4 38 discord.com 162.159.135.232, 443, 49741, 49746 CLOUDFLARENETUS United States 8->38 40 cdn.discordapp.com 162.159.135.233, 443, 49747, 49777 CLOUDFLARENETUS United States 8->40 34 C:\Users\user\AppData\Local\...\Bkppdrv.exe, PE32 8->34 dropped 56 Writes to foreign memory regions 8->56 58 Allocates memory in foreign processes 8->58 60 Creates a thread in another existing process (thread injection) 8->60 17 ieinstal.exe 2 3 8->17         started        20 notepad.exe 4 8->20         started        62 Multi AV Scanner detection for dropped file 13->62 64 Injects a PE file into a foreign processes 13->64 22 ieinstal.exe 13->22         started        42 162.159.130.233, 443, 49780 CLOUDFLARENETUS United States 15->42 44 162.159.136.232, 443, 49778, 49779 CLOUDFLARENETUS United States 15->44 46 192.168.2.1 unknown unknown 15->46 24 ieinstal.exe 15->24         started        file5 signatures6 process7 dnsIp8 36 boot.awsmppl.com 185.165.153.126, 2266, 49761 DAVID_CRAIGGG Netherlands 17->36 26 cmd.exe 1 20->26         started        28 cmd.exe 1 20->28         started        process9 process10 30 conhost.exe 26->30         started        32 conhost.exe 28->32         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/33e6263b0e9dbd16c509e5701a60e4615feda4713fad24c75f51c94e5e53f5cb/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 07:36:26 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gptcmoyotw6rnrij4vybuyhemfp63jdrh6wsjr27kheu4xst6xfq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
44959082a4d86b4b782a2d860658e304025d34863398da161e39ba57a7e2c4fd
ModiLoader
47d694226b7f034e868ded9f3ebc12b1afbf9bbccb791f4a98c61955f10efa19
ModiLoader
53136d19559089e0674af4ad81621b99a031741edcc486eb3d402fd180b1b77e
ModiLoader
72427a1ab5dbf3e5c6d4f297ec33becb68bc39d1c8446f98c47d1560f6371a3a
ModiLoader
7f53893a9ce40e497ef34ecfc9c4f493b9d5dd7f989b60ffa248cbf289a1505a
ModiLoader
a1c561c21720c4f1c3626276db6afc2c12b1aae9304c78518763eb78454f84b8
ModiLoader
b44ef524ef77ea1ee0bcb7096b328f6f94a4621df0d15114e8ff43e83483bbc6
ModiLoader
c86bcfe4e22cb50054b44e38fc4fb79624c4ed5bf9a26174754dbb5c1a6baff8
ModiLoader
ce30dea0b1d4fa181753600eb63c1d2f1a7de1bd848dcdbe196f6a35afef0ea9
ModiLoader
dc1c1c501965a46f02d345785cd1ec1f9bdb74f2defe3402c9e2b4a6f0959b8a
ModiLoader
+ 1'066 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
persistence trojan family:modiloader rat family:remcos
Link:
https://tria.ge/reports/201016-5c42tb3y3s/
Behaviour
Modifies registry key
Modifies system certificate store
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Adds Run key to start application
ModiLoader Second Stage
ModiLoader, DBatLoader
Remcos
Unpacked files
SH256 hash:
33e6263b0e9dbd16c509e5701a60e4615feda4713fad24c75f51c94e5e53f5cb
MD5 hash:
a0e2bb70814ce5319f6a5a5ffb1e21e4
SHA1 hash:
7289217e59872deb50a8bd788038e8551959c3e2
Link:
https://www.unpac.me/results/fa44a312-eee1-4058-80d5-7d0cde234d35/
SH256 hash:
fff782830f323f49473402aac087bea89fa319afd0fe504476c9e8b038f9fce8
MD5 hash:
453044cd27142581835d24c31905ab10
SHA1 hash:
82e53802758d48321c9cf737b83547ae19b93286
Link:
https://www.unpac.me/results/fa44a312-eee1-4058-80d5-7d0cde234d35/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/33e6263b0e9dbd16c509e5701a60e4615feda4713fad24c75f51c94e5e53f5cb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

img 79d4d2c899fec4a401049b8f38bb17d1d54cdec351f00ed0e0af38ff5e1235ab

ModiLoader

Executable exe 33e6263b0e9dbd16c509e5701a60e4615feda4713fad24c75f51c94e5e53f5cb

(this sample)

  
Dropped by
MD5 f3fc747b672d13d939059592e6dc4f03
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/72035/
  
Dropped by
SHA256 79d4d2c899fec4a401049b8f38bb17d1d54cdec351f00ed0e0af38ff5e1235ab

Comments