MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4cc2e534b544c2bd3b2508959965c9b11f9b7c6ce341332e6aab3509af066cde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4cc2e534b544c2bd3b2508959965c9b11f9b7c6ce341332e6aab3509af066cde
SHA3-384 hash: 40119f6d5722c27016240dc75b57afe936dd5988e9660def94a285bb0d369afa29213dd291c4beebf0bc310e2fbb6ceb
SHA1 hash: 1a3664df56eeffa8755a20e52d23848f50fe95de
MD5 hash: 67fabfbd42d3ec84fdc3cb39adda1b70
humanhash: speaker-april-comet-undress
File name:PO CBV87654468.pdf.exe
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'161'528 bytes
First seen:2020-10-27 10:08:32 UTC
Last seen:2020-10-27 12:16:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 24a4caa171cf0a3c7ac6185c64ca5d29 (13 x ModiLoader, 3 x RemcosRAT)
ssdeep 12288:GJROS/D7RYUfXkIlC+23Oy55Wf/lJrQGo/uV9S7AlPBbrEZlgfkmHvXbCyVsQHwG:GP3taIH23P5IJRqU3rLCX9G
Threatray 1'244 similar samples on MalwareBazaar
TLSH C6358DE2A69504E6F132EA788F7746E345FDBC3138384CA536A82D097AFF1412D5ED42
Reporter abuse_ch
Tags:exe ModiLoader


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: email.asiaepmail.com
Sending IP: 52.187.42.126
From: Ica Wulandari <sale1@mts.com.sa>
Subject: RE: Order PO CBV87654468
Attachment: PO CBV87654468.pdf.iso (contains "PO CBV87654468.pdf.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/79779/
Detection(s):
PUA.Win.Packer.PrivateEXEProtector4-6192998-2
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Launching a process
Creating a file
Running batch commands
Creating a process with a hidden window
Deleting a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Connection attempt to an infection source
Unauthorized injection to a system process
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/513206
Signature
Contains functionality to detect sleep reduction / modifications
Initial sample is a PE file and has a suspicious name
Multi AV Scanner detection for submitted file
Uses an obfuscated file name to hide its real file extension (double extension)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4cc2e534b544c2bd3b2508959965c9b11f9b7c6ce341332e6aab3509af066cde/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 07:13:30 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jtboknfvitbl2ozfbckzszojwepzw7dm4natgltkvm2qtlygntpa._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0abf0f61f1a7805aedb6e7b825de9ab83042f00d7ed6f0af817e45fe5c67c7bd
ModiLoader
31963673bc347fe4a6c795c90a0bcbddbf701158feab1b831bce2b082aeacf7f
ModiLoader
46ff7f6619eda7e3b2c5b36a2d3f21b154749d31ae2695c4d23c992361ce1f58
ModiLoader
5b1f1843bbb992e3d5c635aa69d8409de4ae4d3f04cf19994d8e953e99cf451a
ModiLoader
5b6f4a000f03183f2bbbebf07130189f5f5b9617dba37f9b90980ec228ba8180
ModiLoader
99a8e371d2d05838012be53f7e86a675acdc9be4770eb4372779a85a574c2f1a
ModiLoader
9b60c965a1425ff01954ce6a917cb4486d5af5cb36f538233139042ea324a64e
ModiLoader
b8c6d9ced99143d34fd8829125c6ff46bc0c55569f401ec4d1354f3d0825c4c4
ModiLoader
c358b44f578fd2dedbb1899038415395ae2052c113aaa149481cde295e022bda
ModiLoader
ce30dea0b1d4fa181753600eb63c1d2f1a7de1bd848dcdbe196f6a35afef0ea9
ModiLoader
+ 1'234 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
rat family:remcos persistence trojan family:modiloader
Link:
https://tria.ge/reports/201027-8gw9g4rcv6/
Behaviour
Modifies registry key
Script User-Agent
Suspicious use of WriteProcessMemory
Adds Run key to start application
ModiLoader First Stage
ModiLoader Second Stage
ModiLoader, DBatLoader
Remcos
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dsc
Create hunting rule
Author:Aaron DeVera
Description:Discord domains
Rule name:MALWARE_Win_DLAgent03
Create hunting rule
Author:ditekSHen
Description:Detects known Delphi downloader agent downloading second stage payload, notably from discord

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

iso 1938cc7b64c7de88fee64d6cbe7f44bf50f478e2de02b03ca8b5f38467c0ea6b

ModiLoader

Executable exe 4cc2e534b544c2bd3b2508959965c9b11f9b7c6ce341332e6aab3509af066cde

(this sample)

  
Dropped by
MD5 2307c57e1559fac3835cc34a49f3c66b
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 1938cc7b64c7de88fee64d6cbe7f44bf50f478e2de02b03ca8b5f38467c0ea6b
Cape
Cape
https://www.capesandbox.com/analysis/79779/

Comments