MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37d784463964139b15ff2609fc173c430482c6feebef4a13a37df143e99468e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37d784463964139b15ff2609fc173c430482c6feebef4a13a37df143e99468e5
SHA3-384 hash: 56227b70087d8de5b138a63bf69bd7769e9bf711b91dbde5ec2e48dd8faf0d646099fae4f7eb590491a555e09528786c
SHA1 hash: 82d6cc67ab0504f382b650a88209f2eb9170bd02
MD5 hash: 8dbd1974c93ac8b07e9cf7cc730bda85
humanhash: winter-fruit-twenty-nineteen
File name:Scan_copy00556.bat
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'066'544 bytes
First seen:2020-10-21 08:55:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 43f29e85d3150ea9833f321c3be626c8 (9 x ModiLoader, 1 x NetWire, 1 x AveMariaRAT)
ssdeep 12288:WhVKeF40BRicbRToD1whMmvlThTD3mG91gX2jU6vl4fMsdF6eIDx:WhU0RicG6b9T17mG9uX2NlDkF6zDx
Threatray 1'709 similar samples on MalwareBazaar
TLSH E6356C627290C332D072C6B9CD5FA6787599FE40ED287846F7AC7D4A6F35E81202B247
Reporter abuse_ch
Tags:bat ModiLoader


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: bik0.monoi-logistics.com
Sending IP: 94.140.114.91
From: Uyen Tan <uyentan@santech.com>
Subject: Re: regarding payment
Attachment: Scan_copy00556_pdf.gz (contains "Scan_copy00556.bat")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/73922/
Detection(s):
SecuriteInfo.com.Artemis40C354B68313.10960.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Creating a file
Moving of the original file
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/505473
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/37d784463964139b15ff2609fc173c430482c6feebef4a13a37df143e99468e5/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 06:50:05 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g7lyirrzmqjzwfp7eye7yfz4imcifrx65pxuue5dpxyuh2mundsq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
00e02f7c8cf2c1f9180edba4765eac1b46ce9f7bd25e10d712b07297e7ce31f0
ModiLoader
1e16abfda8f084403f909b32b0998fd41e43b44a7fa0733e080399cf7a77d3c7
ModiLoader
393563ba21c2c9349e3a0be9712ba9b9911297485360881d100775ff4ba2fd33
ModiLoader
4d9b378b9a46745f4987b348e6d3c7d0e3238cf23284c5551e457f28dc3a726b
ModiLoader
5521ef291f90c10acfd6e796a6ad2cb099a14da80bd09c6e8ffe0710c8eb547c
ModiLoader
76e0ef504371de843a6197e948a1a1dfe3f8e87e25ff8e2ee5f6648daff0e0c6
ModiLoader
8b2bf895a6d6db530ed42449ef1691d13c85a9091993e3b6bc1530456617ce29
ModiLoader
b9929d5795c560d38f4e9a62b9f67c125f05af52411b0f780ccdaf30c5940a76
ModiLoader
d3f6aadfe6a7794bfc6394f6f65e83127696d959c0d79b1de0eb483e75b3be01
ModiLoader
f37e150f7ac1a5fbd8541b51f7b42951d4858caafcd29ee15d48020d58035efa
ModiLoader
+ 1'699 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
spyware trojan stealer family:lokibot family:modiloader
Link:
https://tria.ge/reports/201021-31pbe29z9j/
Behaviour
Modifies system certificate store
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
ModiLoader First Stage
ModiLoader Second Stage
Lokibot
ModiLoader, DBatLoader
Malware Config
C2 Extraction:
https://itrad3r.com/iff/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
37d784463964139b15ff2609fc173c430482c6feebef4a13a37df143e99468e5
MD5 hash:
8dbd1974c93ac8b07e9cf7cc730bda85
SHA1 hash:
82d6cc67ab0504f382b650a88209f2eb9170bd02
Link:
https://www.unpac.me/results/8ff455b7-caca-4ab2-94c4-2cc8e5631161/
SH256 hash:
09d882b9f2ee1b1c4e741148bff6022ad2dc954336f4a0068e74ac44b8c0da90
MD5 hash:
2d396f6b17ced0f5bbe35732b059f39a
SHA1 hash:
f99451819cad0af6dc99df27d3c59ac47c50a2ec
Link:
https://www.unpac.me/results/8ff455b7-caca-4ab2-94c4-2cc8e5631161/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

gz f68c16489fceb172402735c363f05014468f6ac5b747895bbaf4134ceaa2a920

ModiLoader

Executable exe 37d784463964139b15ff2609fc173c430482c6feebef4a13a37df143e99468e5

(this sample)

  
Dropped by
MD5 35814265e42e6a7d19909f0f84348330
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/73922/
  
Dropped by
SHA256 f68c16489fceb172402735c363f05014468f6ac5b747895bbaf4134ceaa2a920

Comments