MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3a292d53f973c07d523f5e7095317183338c0f71293695837a6575ab323a196e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
ModiLoader
Vendor detections: 7
| SHA256 hash: | 3a292d53f973c07d523f5e7095317183338c0f71293695837a6575ab323a196e |
|---|---|
| SHA3-384 hash: | 7d8792c38897b9710e776b1808cbdf699a8d29022b608bac680b3ad10a8cb3b17f8d0b7a54c293fe84bff7ea2f33d29e |
| SHA1 hash: | 6ca26dcc9370f1ee7a1a5c7adbd95cd63f82c1ff |
| MD5 hash: | 11217d8a7fdd90d1578e28af5fa5c453 |
| humanhash: | harry-beryllium-six-sad |
| File name: | Blntaie_Signed_.exe |
| Download: | download sample |
| Signature | ModiLoader |
| File size: | 1'320'456 bytes |
| First seen: | 2020-10-09 07:33:41 UTC |
| Last seen: | 2020-10-09 08:42:22 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 7d3e89b16ba0d66bb1ffb3848ff742e0 (4 x ModiLoader, 1 x RemcosRAT) |
| ssdeep | 12288:0onlgoDygsQFgvMGgxZpjKvtg+7agQNVTIR+qixf0McyUm3jhpny2mO:0olgVfZvMhQRxW0qvzyI |
| Threatray | 2 similar samples on MalwareBazaar |
| TLSH | 56557D12B281DC36D1E21D39DD1BD2B8E926BE506D27A48737E43F4DBF353513A1A282 |
| Reporter |  GovCERT_CH |
| Tags: | ModiLoader |
Intelligence
File Origin
# of uploads :
2
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
DNS request
Connection attempt
Launching the default Windows debugger (dwwin.exe)
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Exploit.CVE-2017-11882
Status:
Malicious
First seen:
2020-10-08 22:42:21 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
suspicious
Result
Malware family:
modiloader
Score:
10/10
Tags:
trojan family:modiloader
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
ModiLoader First Stage
ModiLoader, DBatLoader
Unpacked files
SH256 hash:
3a292d53f973c07d523f5e7095317183338c0f71293695837a6575ab323a196e
MD5 hash:
11217d8a7fdd90d1578e28af5fa5c453
SHA1 hash:
6ca26dcc9370f1ee7a1a5c7adbd95cd63f82c1ff
SH256 hash:
8c29c3b66df3a13f89d1e1b2fd2a8a255b73955a277cd0f62b1fccc17a6d02ce
MD5 hash:
632ec2f67484906d9b8f550440382407
SHA1 hash:
fdbaa0c86e33b49f505af55c659ccc5dcae587cf
Detections:
win_dbatloader_g0
win_dbatloader_auto
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
0c7c72af883a29ab08edb54f9d378b736c1cc2fd32dffe0b7bd1e6858b47e4a1
Dropped by
MD5 e1aca7ee3706fcfcf6d198df0215a81c
Dropped by
SHA256 0c7c72af883a29ab08edb54f9d378b736c1cc2fd32dffe0b7bd1e6858b47e4a1
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.