MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fd695117a6e08fa904e7bc528640c25ac5cf17055bc75b39748dbb4bf9c3af9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4fd695117a6e08fa904e7bc528640c25ac5cf17055bc75b39748dbb4bf9c3af9
SHA3-384 hash: 725261c2f1d7b7ec1df66cbf099059754f7326acaf225ae5bf21e37d02b4797a64bd742cbd063a205e7b1e6c6739722c
SHA1 hash: 5f6d81c356884db5f61967532c4da6b79e387f4a
MD5 hash: 6cb6f7cef28a7a5ea1ce5da5dc8e72a4
humanhash: xray-angel-hot-friend
File name:04352562561652.exe
Download: download sample
Signature ModiLoader
Create hunting rule
File size:702'976 bytes
First seen:2023-03-24 12:14:13 UTC
Last seen:2023-04-03 05:54:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash dafc4f5e149ed150bd97ebd590d5ac53 (1 x ModiLoader)
ssdeep 12288:XP31nwx3zw3CxeCSimftjiCLc5oUyjfhCPhVzwUfNOXxeM36j:fFnozwSeConLnUyTmTzwjxt36
Threatray 2'479 similar samples on MalwareBazaar
TLSH T1ECE49D21EA908437C13355798F4BE7A4682CBD316E14BE8EAFD02D9C5E792817D253B3
TrID 28.5% (.SCR) Windows screen saver (13097/50/3)
22.9% (.EXE) Win64 Executable (generic) (10523/12/4)
14.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
9.8% (.EXE) Win32 Executable (generic) (4505/5/1)
6.5% (.MZP) WinArchiver Mountable compressed Archive (3000/1)
File icon (PE):PE icon
dhash icon e4eaa28a849c8ca4 (2 x AveMariaRAT, 1 x ModiLoader)
Reporter Anonymous
Tags:exe ModiLoader

Intelligence

File Origin
# of uploads :
3
# of downloads :
240
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
04352562561652.exe
Verdict:
Malicious activity
Analysis date:
2023-03-24 12:14:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3ee02d35-d628-40e5-9c84-4a2bccfef205

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/377086/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Launching a process
Creating a process with a hidden window
Launching cmd.exe command interpreter
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/74579/overview
Behaviour
MalwareBazaar
CheckScreenResolution
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook keylogger modiloader overlay packed remcos shell32.dll
Link:
https://www.filescan.io/uploads/641d944780ca4ca1ff58dfa7/reports/8b365383-c0a4-488a-97ce-2c6f390a0e82/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/4fd695117a6e08fa904e7bc528640c25ac5cf17055bc75b39748dbb4bf9c3af9
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/40e49316-062b-4bc8-b6a1-ef1b4b8ff87d
Result
Threat name:
DBatLoader
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1201218
Signature
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected DBatLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4fd695117a6e08fa904e7bc528640c25ac5cf17055bc75b39748dbb4bf9c3af9/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-03-23 12:33:21 UTC
File Type:
PE (Exe)
Extracted files:
43
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j7ljkel2nyepvecoppcsqzamewwfz4lqkw6hlm4xjdn3jp44hl4q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
3053bf83f68a367d52f30660d789d79bc26b7829af496864e777ad8a38450366
ModiLoader
45d68cb2a4e2ea11ba073766a2de69759539026cc66a0215f48ff46342e3ed84
ModiLoader
4a85949b7ffe19e22e4191b55b225cb3ac8b59246785144f585006b94e9ba574
ModiLoader
60e62d5459b1971893914ca21242c08a31cdc2dcdeed79e92c0b594e43bf8ec5
ModiLoader
bec4ef3573fb041d4a688c353f4682186f2bfe3918e9add4b9c5ceda5ec2627c
ModiLoader
d11933411093e586653221106dbd02ee574044b4ca7f1bf9d91c6c558b00acdd
ModiLoader
e4a8a88bffaf744487df4bfd56f975542f59efb4aabe037f2ce5baea61875f98
ModiLoader
+ 2'469 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:xloader campaign:euv4 loader persistence rat trojan
Link:
https://tria.ge/reports/230324-pewreagc6y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
ModiLoader Second Stage
Xloader payload
ModiLoader, DBatLoader
Xloader
Unpacked files
SH256 hash:
b802455cfd970c61802a450e21f64ec4e05c0206f446bbe3685343df09c63762
MD5 hash:
f6c5fc2fc1eafe66688164a9f4810a6c
SHA1 hash:
e342e2bc5127e8738eb8355a1ab25599d48a0c94
Link:
https://www.unpac.me/results/71fd31a3-4516-4d8d-9dca-e59fcd719437/
SH256 hash:
0fdc24568d69400ccf449973f922d1a9c37658d8fd03fddc86a4681f62ba5e6c
MD5 hash:
1b30b8a39c46ee317f392f8992ff19bc
SHA1 hash:
12d59f4aef837d6ff8cf46efe2cb4b0cf14eec23
Detections:
win_dbatloader_g1
Create hunting rule
Link:
https://www.unpac.me/results/71fd31a3-4516-4d8d-9dca-e59fcd719437/
Parent samples :
1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d
4fd695117a6e08fa904e7bc528640c25ac5cf17055bc75b39748dbb4bf9c3af9
ab032688523c2d7c7d0c7e829a3761fe59797d0d9b24789c94b7d0a6e5e30c29
c2ea82e013d071b92727a34296c5f5aac06c125a1f2c56917af8ebc06ac6183e
aee5d1b7326545ff692b98743e04d035e01415300fea8a5bf445d3490d6776cc
d061bccf32fbb8184f85439a17e4fcece7f816ea93681a80c7506e159f043cbf
SH256 hash:
4fd695117a6e08fa904e7bc528640c25ac5cf17055bc75b39748dbb4bf9c3af9
MD5 hash:
6cb6f7cef28a7a5ea1ce5da5dc8e72a4
SHA1 hash:
5f6d81c356884db5f61967532c4da6b79e387f4a
Detections:
DbatLoaderStage1
Create hunting rule
Link:
https://www.unpac.me/results/71fd31a3-4516-4d8d-9dca-e59fcd719437/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4fd695117a6e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DBatLoader
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4fd695117a6e08fa904e7bc528640c25ac5cf17055bc75b39748dbb4bf9c3af9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CMD_Ping_Localhost
Create hunting rule
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/377086/

Comments