MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 56a571913ec8c7c4e9c936ac2625f36478147528542a2e291d6ad2cc4a7aab58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
ModiLoader
Vendor detections: 8
| SHA256 hash: | 56a571913ec8c7c4e9c936ac2625f36478147528542a2e291d6ad2cc4a7aab58 |
|---|---|
| SHA3-384 hash: | 2ec00c228343ef757ddd0c0b37563bfa1f848ed0686c0dee3c830b65532d0aae9921bda77bbdbc6059f9cf37b2bead22 |
| SHA1 hash: | b3c83263ddca61d29b5b2e3351bc23a40b4116ea |
| MD5 hash: | 4776632e3c4a24e4a0d8a63061070c24 |
| humanhash: | undress-cup-fix-oxygen |
| File name: | RFQPR2000293356.exe |
| Download: | download sample |
| Signature | ModiLoader |
| File size: | 1'060'184 bytes |
| First seen: | 2020-12-09 11:01:33 UTC |
| Last seen: | 2020-12-09 13:02:32 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | b533f6ccb714ea0a0f83e1cff60dbfe0 (8 x ModiLoader, 2 x RemcosRAT) |
| ssdeep | 24576:vklbZpRNhPXNH/yLjaKuOfl4bE7D/cX+2hu0aQ:vkhRXNNKuOt4U/2vhuxQ |
| Threatray | 570 similar samples on MalwareBazaar |
| TLSH | D235BFE2F2D1457EF1320570DD079579A828EE182E8E9C4627FD2E0C4F796C6381B99B |
| Reporter |  abuse_ch |
| Tags: | exe ModiLoader |
abuse_ch
Malspam distributing ModiLoader:HELO: s15-116-232.thcservers.com
Sending IP: 91.235.116.232
From: Sayumporn Sinworn <sayumporn-sinworn@pioneer-thailand.com>
Reply-To: sayumporn-sinworn@pioneer-thailand.com
Subject: RFQ PR 2000293356
Attachment: RFQPR2000293356.rar (contains "RFQPR2000293356.exe")
Intelligence
File Origin
# of uploads :
2
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQPR2000293356.exe
Verdict:
No threats detected
Analysis date:
2020-12-09 11:54:02 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a window
DNS request
Sending a custom TCP request
Creating a file
Launching a process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Sending a TCP request to an infection source
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
NetWire
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Allocates memory in foreign processes
Contains functionality to log keystrokes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Internet Explorer form passwords
Creates a thread in another existing process (thread injection)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NetWire
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Threat name:
Win32.Infostealer.Fareit
Status:
Malicious
First seen:
2020-12-09 08:48:05 UTC
AV detection:
27 of 28 (96.43%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
netwirerc
Similar samples:
+ 560 additional samples on MalwareBazaar
Result
Malware family:
netwire
Score:
10/10
Tags:
family:modiloader family:netwire botnet persistence stealer trojan
Behaviour
Modifies system certificate store
Suspicious use of WriteProcessMemory
Adds Run key to start application
ServiceHost packer
ModiLoader, DBatLoader
Netwire
Unpacked files
SH256 hash:
0029ae468645fd6a0dec170ab13b11984d937204908ffcf3c636206dfb99affc
MD5 hash:
6f176b84516a9735e3dec241243ea7cb
SHA1 hash:
3b3b161bff6b4ede45f61ae2102d657f8e580dd5
SH256 hash:
56a571913ec8c7c4e9c936ac2625f36478147528542a2e291d6ad2cc4a7aab58
MD5 hash:
4776632e3c4a24e4a0d8a63061070c24
SHA1 hash:
b3c83263ddca61d29b5b2e3351bc23a40b4116ea
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.