MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36ba79ff2db7b282786498c40ec83075e54b15f42021cbbc7289036e12e07a18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36ba79ff2db7b282786498c40ec83075e54b15f42021cbbc7289036e12e07a18
SHA3-384 hash: e29ddefc6d95cc3e43e6f8a66c06c62f3dbb54317a0cc6d5bd46a8c25bf65bc10c115885c6c17f651996386ab6435976
SHA1 hash: 5b0bf1ad65538104f978edd4981aec923f13dfae
MD5 hash: 47f13dd70dfc7487281d4b4e3da44b58
humanhash: nuts-seventeen-echo-apart
File name:IMG-356356.exe
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'161'016 bytes
First seen:2020-10-27 12:45:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 24a4caa171cf0a3c7ac6185c64ca5d29 (13 x ModiLoader, 3 x RemcosRAT)
ssdeep 12288:gJROS/D7RYUfXkIlC+23Oy55Wf/lJrQG7/uV9S7AlPBbrEZlgfkmHvXbCyVsQHwQ:gP3taIH23P5IJEqU3rLCX9Q
Threatray 668 similar samples on MalwareBazaar
TLSH 4A359DE2A69504E6F162EA788C77566345F5BC3138388CA536E82D087EFF1813D9ED43
Reporter abuse_ch
Tags:exe ModiLoader


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: mail.h-email.net
Sending IP: 192.119.86.173
From: GloriaT@paramountglobal.com
Reply-To: sales01-micargichina@mail.com
Subject: Aw:
Attachment: IMG-356359.IMG (contains "IMG-356356.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/79896/
Detection(s):
PUA.Win.Packer.PrivateEXEProtector4-6192998-2
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
DNS request
Sending a custom TCP request
Creating a file
Launching a process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Connection attempt to an infection source
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/513534
Signature
Contains functionality to detect sleep reduction / modifications
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36ba79ff2db7b282786498c40ec83075e54b15f42021cbbc7289036e12e07a18/
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 10:57:09 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g25ht7znw6zie6detdca5sbqoxsuwfpueaq4xpdsrebw4exapima._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
1cbd9abf72988dd36f382b42d50cd46dfbecc2a763764d44eb752dcd2d026651
ModiLoader
21cef6da04f726523131dbde12855b6d1d6d65cc9b0075d05b90b7636b56c8da
ModiLoader
2928d0d53b459f6b822fd781360a743b3548f31c31c012ba8a25b42235aff154
ModiLoader
8cafd9b602e666abf81ea94c48663a8a1ebbf06746ed799be5184ecb748ae304
ModiLoader
9a6951c6f3c33c217edd9a4e32f5422c4e125b909d0c88e190b76eb695f05b72
ModiLoader
9de5e8e2d7733dfcf568e5b11a95d2468ef905e90169d7a4c93e1909a0372f04
ModiLoader
e6db6d5f9019bdefffc749264a267c1927dcf5eba5a7ea3dfb10db457b6b2a16
ModiLoader
ece26faace5bcf7afeba359279d17aeb7f99f739fce454e964c88ebad9745bdb
ModiLoader
f24e45d41404cdbd5b3e88ef39f6b047d062ade5cb3bddbe2ad40d5331e27210
ModiLoader
fc70d13e41ab6c3d36b72e329549c48e70767e37b06c5bbe7284896e935c6815
ModiLoader
+ 658 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:netwire botnet persistence rat stealer trojan
Link:
https://tria.ge/reports/201027-9jexrssgmn/
Behaviour
Script User-Agent
Suspicious use of WriteProcessMemory
Adds Run key to start application
ModiLoader First Stage
ModiLoader Second Stage
ServiceHost packer
ModiLoader, DBatLoader
NetWire RAT payload
Netwire
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/36ba79ff2db7b282786498c40ec83075e54b15f42021cbbc7289036e12e07a18

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dsc
Create hunting rule
Author:Aaron DeVera
Description:Discord domains
Rule name:MALWARE_Win_DLAgent03
Create hunting rule
Author:ditekSHen
Description:Detects known Delphi downloader agent downloading second stage payload, notably from discord

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

img 0d3a2373d695bcb95d34d38ed65709b7239f1f30fd94af3616cb7fce9abf7001

ModiLoader

Executable exe 36ba79ff2db7b282786498c40ec83075e54b15f42021cbbc7289036e12e07a18

(this sample)

  
Dropped by
MD5 c16e13dadee9a66f6a78b811f3af188d
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/79896/
  
Dropped by
SHA256 0d3a2373d695bcb95d34d38ed65709b7239f1f30fd94af3616cb7fce9abf7001

Comments