MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 823ac795c82f035c86b71f68c8e77eea1ef916c77502d78fc2081d3fd660cde0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
ModiLoader
Vendor detections: 10
| SHA256 hash: | 823ac795c82f035c86b71f68c8e77eea1ef916c77502d78fc2081d3fd660cde0 |
|---|---|
| SHA3-384 hash: | c8e269fc151082f9a6a9341c273921b1a548afb2e504cb6887ba3ad4422c1dd7b4729c52b02616db3a03839238e69111 |
| SHA1 hash: | a51a3fd810e590db92a14dc44ab477c5cbc9a43a |
| MD5 hash: | 138cb27a71d15bc43984cd355b612dfa |
| humanhash: | gee-yellow-bluebird-kitten |
| File name: | PURCHASE_ORDER#648190121.exe |
| Download: | download sample |
| Signature | ModiLoader |
| File size: | 725'504 bytes |
| First seen: | 2021-01-19 07:55:04 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5064414005440c05f6346292b90ee3f2 (7 x RemcosRAT, 3 x Loki, 2 x ModiLoader) |
| ssdeep | 6144:XY9xV0Zof7rY2hfRzeLp7vI0Foas/ZvGmCIIQUbJYaVHjqgCXUFJn60lL06BZzJ8:mxVyof7rYaf81stsbFYooXiJ6N6BbUd |
| Threatray | 504 similar samples on MalwareBazaar |
| TLSH | E6F47D66A2E80773C12B297D5C27E661AD257D0D3D29584A3BD43C0C9F393B2382D5AF |
| Reporter |  abuse_ch |
| Tags: | exe ModiLoader |
abuse_ch
Malspam distributing unidentified malware:HELO: regular1.263xmail.com
Sending IP: 211.150.70.195
From: Omega TCL-Purchase <zhangjb@liugong.com>
Subject: New order.
Attachment: PURCHASE_ORDER#648190121.rar (contains "PURCHASE_ORDER#648190121.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PURCHASE_ORDER#648190121.exe
Verdict:
Malicious activity
Analysis date:
2021-01-19 08:05:34 UTC
Tags:
rat agenttesla
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
DNS request
Sending an HTTP GET request
Creating a file
Deleting a recently created file
Launching a process
BSOD occurred
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Forced shutdown of a system process
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Signature
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Svchost Process
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2021-01-19 07:55:14 UTC
AV detection:
10 of 46 (21.74%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 494 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Score:
10/10
Tags:
family:agenttesla family:modiloader keylogger persistence spyware stealer trojan
Behaviour
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
AgentTesla
Unpacked files
SH256 hash:
823ac795c82f035c86b71f68c8e77eea1ef916c77502d78fc2081d3fd660cde0
MD5 hash:
138cb27a71d15bc43984cd355b612dfa
SHA1 hash:
a51a3fd810e590db92a14dc44ab477c5cbc9a43a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.