MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fb4f85646ca28a28ebcbdf6abc944530a57222c7c57b90538a3fb1e436632d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5fb4f85646ca28a28ebcbdf6abc944530a57222c7c57b90538a3fb1e436632d5
SHA3-384 hash: bbde4fb84d77a38e808bf2d7883edea6dfea0244445cf5e283a469372ffc0ad9faaf19d2f28094ccbb4e9b5e24e5a415
SHA1 hash: 9965262d9ccfdf66cfd404d9c86cec7ad1884c5c
MD5 hash: e99202275a4ceea80b2a7670e60017a5
humanhash: fifteen-aspen-shade-romeo
File name:IT3(b) certificate_846392852289725282735792726639.exe
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'060'184 bytes
First seen:2020-12-09 11:03:23 UTC
Last seen:2020-12-09 13:02:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b533f6ccb714ea0a0f83e1cff60dbfe0 (8 x ModiLoader, 2 x RemcosRAT)
ssdeep 24576:vklbZpRNhPXNH/yLjaKuOfl80E7D/cX+2hu0aQ:vkhRXNNKuOt8T/2vhuxQ
Threatray 1'307 similar samples on MalwareBazaar
TLSH DD35BEE2F6D0413EF13605709D4795757828EE192E8EA84627BE2F0C0F7D6C6381B99B
Reporter abuse_ch
Tags:exe ModiLoader


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: rdns0.notifyme.website
Sending IP: 145.239.35.251
From: Standard Bank <Client.Queries@standardbank.com.na>
Subject: SBSA IT3(b) Certificate Updated
Attachment: IT3(b) certificate.img (contains "IT3(b) certificate_846392852289725282735792726639.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
IT3(b) certificate_846392852289725282735792726639.exe
Verdict:
Malicious activity
Analysis date:
2020-12-09 11:11:42 UTC
Tags:
trojan rat remcos
Link:
https://app.any.run/tasks/1c7e1186-fa35-4c55-ac1e-4180f4a86bf7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/107454/
Detection(s):
PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

PUA.Win.Adware.Qjwmonkey-6892535-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Creating a file
Launching a process
Sending a UDP request
Creating a window
DNS request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Result
Gathering data
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/558957
Signature
Allocates memory in foreign processes
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Creates a thread in another existing process (thread injection)
Detected Remcos RAT
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 328575 Sample: IT3(b) certificate_84639285... Startdate: 09/12/2020 Architecture: WINDOWS Score: 100 25 g.msn.com 2->25 39 Malicious sample detected (through community Yara rule) 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Detected Remcos RAT 2->43 45 6 other signatures 2->45 7 Locsdrv.exe 14 2->7         started        11 IT3(b) certificate_846392852289725282735792726639.exe 1 16 2->11         started        14 Locsdrv.exe 13 2->14         started        signatures3 process4 dnsIp5 29 162.159.130.233, 443, 49736 CLOUDFLARENETUS United States 7->29 47 Multi AV Scanner detection for dropped file 7->47 49 Contains functionality to inject threads in other processes 7->49 51 Writes to foreign memory regions 7->51 16 ieinstal.exe 7->16         started        31 discord.com 162.159.128.233, 443, 49721, 49735 CLOUDFLARENETUS United States 11->31 33 cdn.discordapp.com 162.159.134.233, 443, 49722 CLOUDFLARENETUS United States 11->33 23 C:\Users\user\AppData\Local\...\Locsdrv.exe, PE32 11->23 dropped 53 Allocates memory in foreign processes 11->53 55 Creates a thread in another existing process (thread injection) 11->55 57 Injects a PE file into a foreign processes 11->57 18 ieinstal.exe 2 11->18         started        35 162.159.135.233, 443, 49740 CLOUDFLARENETUS United States 14->35 37 162.159.136.232, 443, 49739 CLOUDFLARENETUS United States 14->37 21 ieinstal.exe 14->21         started        file6 signatures7 process8 dnsIp9 27 216.38.7.225, 49724, 7082 ASN-GIGENETUS United States 18->27
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5fb4f85646ca28a28ebcbdf6abc944530a57222c7c57b90538a3fb1e436632d5/
Threat name:
Win32.Trojan.Malrep
Create hunting rule
Status:
Malicious
First seen:
2020-12-09 11:04:13 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l62pqvsgziukfdv4xx3kxskekmffoirmprl3sbjyup5r4q3gglkq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
04f271742dac058c042af388562d7678536a47273846d692649926bad5dce1a0
ModiLoader
14a8520afb80692ed77075a5a9e797fa2822a91e5eb43603762669fb65ef2144
ModiLoader
2ccee108cf8e10eeef5129554e97fdb481d375475419be26cff2430360db2689
ModiLoader
74b843d9cabf046a044581d20033d93eecf9d8ea590ce9557569e40d990e6241
ModiLoader
835109646cd221028859f7d4c7de74be962091d60840952ca85053e396fdc593
ModiLoader
91ed2df39c53d7246eb84f3023072797925fa037f3a35c585247afc38322c649
ModiLoader
bd86ba6f082dfd404bc2f3544f5b39ce04084742b334ab00a80f0c12c94daa46
ModiLoader
c0442a7a63a5291b747e22a8e0eabe4abe3e344e6fbc3e4f1a0465895a29b5b2
ModiLoader
e7def582e6c764fb35cad598da8b83da969897d37241402df8c8bac2b870432f
ModiLoader
e8001e686b3c1972277296e3ed20992b8fd67e7c7f8dc16a827e09d3f22b02e0
ModiLoader
+ 1'297 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:remcos persistence rat trojan
Link:
https://tria.ge/reports/201209-n18wyppqpe/
Behaviour
Modifies system certificate store
Suspicious use of WriteProcessMemory
Adds Run key to start application
ServiceHost packer
ModiLoader, DBatLoader
Remcos
Unpacked files
SH256 hash:
5fb4f85646ca28a28ebcbdf6abc944530a57222c7c57b90538a3fb1e436632d5
MD5 hash:
e99202275a4ceea80b2a7670e60017a5
SHA1 hash:
9965262d9ccfdf66cfd404d9c86cec7ad1884c5c
Link:
https://www.unpac.me/results/dbde12e2-dbc5-4af4-aa3a-2dd24f0975e7/
SH256 hash:
e2ebfa622e246ec556d816a1394e545441a606dc3cd87bf21312b434aef0c28b
MD5 hash:
4ccacf591eb0b0fa812ae90a3cb97cd3
SHA1 hash:
c6818a03d346c0cf823f8729a5965bb15f0089bc
Link:
https://www.unpac.me/results/dbde12e2-dbc5-4af4-aa3a-2dd24f0975e7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5fb4f85646ca28a28ebcbdf6abc944530a57222c7c57b90538a3fb1e436632d5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

img b0f11ad53382c81e4a9339c0d79aa6033648a1e16f1e15b1fe81e328fcd3dd91

ModiLoader

Executable exe 5fb4f85646ca28a28ebcbdf6abc944530a57222c7c57b90538a3fb1e436632d5

(this sample)

  
Dropped by
MD5 7f7f7efbc1f20322e1206fdb7a9a072f
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/107454/
  
Dropped by
SHA256 b0f11ad53382c81e4a9339c0d79aa6033648a1e16f1e15b1fe81e328fcd3dd91

Comments