MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49116eb9df67b39271c13a80c5044023c55044c2cb4c6303f2b8c2a936524cee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ModiLoader

Vendor detections: 14

Intelligence 14 IOCs YARA 15 File information Comments

SHA256 hash:	49116eb9df67b39271c13a80c5044023c55044c2cb4c6303f2b8c2a936524cee
SHA3-384 hash:	96844d5900b4e083b5a545d44c29523e725e0273d1dfa3be3dad7953b30a439164fe0912573eae47f47dd31242ca0794
SHA1 hash:	c8cee5411c1c414876f078ecfa9865eb893ad5af
MD5 hash:	8903e7e6ebd4f46e9910e2e6179c2778
humanhash:	black-oscar-white-uniform
File name:	z28098882729202928.exe
Download:	download sample
Signature	ModiLoader Create hunting rule
File size:	1'572'864 bytes
First seen:	2024-06-13 18:34:45 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d1f4aa9c80c93d5b2f227b0db779069a (1 x ModiLoader)
ssdeep	24576:bbkSa/2a3/Sbw8C2eqS03nS696G8dM50uM9gx264PXZDN4MM1dtdrddddddddt:bo3hRqb3nSqMNuvI64PXxNp
TLSH	T11A7527D2E590DC36CF331472FA054FD4D8582DB1F6AC25472D946A6F2AABDE3E40B842
TrID	36.1% (.SCR) Windows screen saver (13097/50/3) 29.0% (.EXE) Win64 Executable (generic) (10523/12/4) 12.4% (.EXE) Win32 Executable (generic) (4504/4/1) 5.7% (.EXE) Win16/32 Executable Delphi generic (2072/23) 5.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	286dad0e33dbcc74 (1 x ModiLoader)
Reporter	FXOLabs
Tags:	exe ModiLoader

Intelligence

File Origin

# of uploads :

# of downloads :

391

Origin country :

Vendor Threat Intelligence

Malware family:

formbook

ID:

File name:

49116eb9df67b39271c13a80c5044023c55044c2cb4c6303f2b8c2a936524cee.exe

Verdict:

Malicious activity

Analysis date:

2024-06-13 18:38:26 UTC

Tags:

fileshare formbook xloader

Link:

https://app.any.run/tasks/cc00d5e2-bb6a-4ae8-8ee7-3bebfece2d07

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Porcupine.Trojan.Win32.Strab.gen.241578.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=666b3c90a2bce47be7d93b1ewin7simulatehigh_evasion

Tags:

Static Nekark

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a window

DNS request

Connection attempt

Sending a custom TCP request

Launching a process

Creating a process with a hidden window

Searching for the window

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-vm borland_delphi fingerprint keylogger packed

Link:

https://www.filescan.io/uploads/666b3be0910ce98966f98e71/reports/1143018d-e95a-4230-9b5d-282466b39786/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/49116eb9df67b39271c13a80c5044023c55044c2cb4c6303f2b8c2a936524cee

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Starter

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a433a77f-1f4c-4779-8bf0-b3d2665e7c4f

Result

Threat name:

DBatLoader, FormBook

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1456842

Signature

AI detected suspicious sample

Allocates memory in foreign processes

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to detect sleep reduction / modifications

Creates a thread in another existing process (thread injection)

Detected unpacking (creates a PE file in dynamic memory)

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Snort IDS alert for network traffic

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected DBatLoader

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/49116eb9df67b39271c13a80c5044023c55044c2cb4c6303f2b8c2a936524cee

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/49116eb9df67b39271c13a80c5044023c55044c2cb4c6303f2b8c2a936524cee/

Threat name:

Win32.Trojan.Remcos

Status:

Malicious

First seen:

2024-06-13 10:40:49 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jeiw5oo7m6zze4obhkamkbcaepcvargcznggga7sxdbksnssjtxa._file

Verdict:

unknown

Result

Malware family:

modiloader

Score:

10/10

Tags:

family:modiloader trojan

Link:

https://tria.ge/reports/240613-w8czqaxfqb/

Behaviour

Modifies Internet Explorer settings

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

ModiLoader Second Stage

ModiLoader, DBatLoader

Unpacked files

SH256 hash:

3c1df672f4e9399171ca2aa6ec1bea39d4d92fad8e72831366a222cde00ab4b9

MD5 hash:

630460ea8f8246577d6f9c8917163bcf

SHA1 hash:

cac2e34ac87f9286a8fbc51f9c3bc89dc72646f8

Link:

https://www.unpac.me/results/ea8c0dba-2bd9-47c0-a6ff-5ffe0353efab/

SH256 hash:

49116eb9df67b39271c13a80c5044023c55044c2cb4c6303f2b8c2a936524cee

MD5 hash:

8903e7e6ebd4f46e9910e2e6179c2778

SHA1 hash:

c8cee5411c1c414876f078ecfa9865eb893ad5af

Link:

https://www.unpac.me/results/ea8c0dba-2bd9-47c0-a6ff-5ffe0353efab/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BobSoftMiniDelphiBoBBobSoft Create hunting rule
Author:	malware-lu

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	Windows_Generic_Threat_0cc1481e Create hunting rule
Author:	Elastic Security

Rule name:	without_attachments Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the no presence of any attachment
Reference:	http://laboratorio.blogs.hispasec.com/

Rule name:	with_urls Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the presence of an or several urls
Reference:	http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

exe 49116eb9df67b39271c13a80c5044023c55044c2cb4c6303f2b8c2a936524cee

(this sample)

Delivery method

Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::CloseHandle kernel32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryExA kernel32.dll::LoadLibraryA kernel32.dll::GetStartupInfoA kernel32.dll::GetDiskFreeSpaceA kernel32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateFileA kernel32.dll::FindFirstFileA version.dll::GetFileVersionInfoSizeA version.dll::GetFileVersionInfoA
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA
WIN_USER_API	Performs GUI Actions	user32.dll::ActivateKeyboardLayout user32.dll::CreateMenu user32.dll::FindWindowA user32.dll::PeekMessageA user32.dll::PeekMessageW user32.dll::CreateWindowExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample