MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a95c6a61523704d369aa61231c2c1ae80c1ce87911f519b4108a40306b2152ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a95c6a61523704d369aa61231c2c1ae80c1ce87911f519b4108a40306b2152ac
SHA3-384 hash: 2a9aa8a2e654cd0bbb4b2b826f4be1713bc72061f398cb32ca2007a5a0d32bd1682c33fde6896ab398d76120010a24e6
SHA1 hash: b0619f161c01496d669afd7b2828a9d117d699b3
MD5 hash: 69d0604790a25ff67938fa344b09d3b3
humanhash: four-fifteen-six-hot
File name:Qyuvbsk_Signed_.exe
Download: download sample
Signature ModiLoader
Create hunting rule
File size:992'000 bytes
First seen:2020-08-13 16:38:51 UTC
Last seen:2020-08-13 17:49:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 63ffa342653757fae1740debddf4f48a (5 x ModiLoader, 1 x RemcosRAT)
ssdeep 12288:jxtU/mq2LfX9V9GrGK4Ilr9Yz4sUvgu+Cj/RegBKYEt8XO+/GFAlNgnPlMwK:jrHLfNDKZ/n5fj/MgB1h5lNgnPqwK
Threatray 1'584 similar samples on MalwareBazaar
TLSH A725CF1B7A815033DB1B073E8C77969D5F2579617C1888A91EE50F8C9E24F9B30BAC1B
Reporter abuse_ch
Tags:exe Lokig ModiLoader


Avatar
abuse_ch
Malspam distributing Loki:

HELO: srvmail.groupecat.com.pl
Sending IP: 5.102.68.34
From: Cuentas <cuentas3@groupecat.com.pl>
Subject: usd tt.
Attachment: PagoSWIFT.xlsm

Loki payload URL:
https://nilemixitupd.biz.pl/zero/Qyuvbsk_Signed_.exe

Loki C2:
http://104.223.143.132/superman/Panel/five/fre.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/45272/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Launching a process
Creating a file
Unauthorized injection to a recently created process
Running batch commands
Creating a process with a hidden window
Reading critical registry keys
Changing a file
Replacing files
Connection attempt
Sending an HTTP POST request
Creating a file in the %AppData% subdirectories
Deleting a recently created file
Stealing user critical data
Moving of the original file
Unauthorized injection to a system process
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/426998
Signature
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Sigma detected: Fodhelper UAC Bypass
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Writes to foreign memory regions
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 266116 Sample: Qyuvbsk_Signed_.exe Startdate: 15/08/2020 Architecture: WINDOWS Score: 100 35 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->35 37 Found malware configuration 2->37 39 Malicious sample detected (through community Yara rule) 2->39 41 5 other signatures 2->41 8 Qyuvbsk_Signed_.exe 2->8         started        process3 dnsIp4 31 cdn.discordapp.com 162.159.133.233, 443, 49744 CLOUDFLARENETUS United States 8->31 43 Tries to steal Mail credentials (via file registry) 8->43 45 Writes to foreign memory regions 8->45 47 Allocates memory in foreign processes 8->47 49 2 other signatures 8->49 12 Qyuvbsk_Signed_.exe 54 8->12         started        16 notepad.exe 4 8->16         started        signatures5 process6 dnsIp7 33 104.223.143.132, 49752, 49753, 49754 LAYER-HOSTUS United States 12->33 51 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->51 53 Tries to steal Mail credentials (via file access) 12->53 55 Tries to harvest and steal ftp login credentials 12->55 29 C:\Users\Public29atso.bat, ASCII 16->29 dropped 19 cmd.exe 1 16->19         started        21 cmd.exe 1 16->21         started        file8 signatures9 process10 process11 23 conhost.exe 19->23         started        25 reg.exe 1 1 19->25         started        27 conhost.exe 21->27         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a95c6a61523704d369aa61231c2c1ae80c1ce87911f519b4108a40306b2152ac/
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 16:40:07 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vfoguyksg4cng2nkmerryla25agbz2dzch2rtnaqrjada2zbkkwa._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
01d0e94a720972c1823b00d8cf58764c46560b5076532ffc8d605c9f7772a50f
ModiLoader
370689025278ad361000a1ad60efb13b4e6af5acc40e667b1db953f1ff911ecc
ModiLoader
4911eacbf571053566aed23d03702266b35696ed0ff025b8fb9912be12e91347
ModiLoader
53edc68ef8a890aac3c8f6fe8c72e1a8cf5057c600a3f85d12b99b59b05e47be
ModiLoader
9bcf29ef3bbb1003db97934e2412dfb77fc1d289797a9b4eab2af243bbc8987f
ModiLoader
a38b59fcafd27a98cf76d8cb795d00dd8b7e9eb0d9a63d196c94fc80a95847d3
ModiLoader
e4632cb7a8a3bf9d0341219f0fa8562c7baf009b2306b149be7e95ae41027405
ModiLoader
f7595540807945b05a9f17f0281245dab4366844dca5765a5798062027412e03
ModiLoader
fb3583ba6033850a64fa69fe07fd3a04a6555943243452329a65c50c318ed75e
ModiLoader
fe36f8b161c6e9f38fba4be32eb2b67846c9c93de9f48028762f79e5ee2b6169
ModiLoader
+ 1'574 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
spyware trojan stealer family:lokibot
Link:
https://tria.ge/reports/200813-qx7llad4bx/
Behaviour
Modifies registry key
Script User-Agent
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://104.223.143.132/superman/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a95c6a61523704d369aa61231c2c1ae80c1ce87911f519b4108a40306b2152ac

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_dbatloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

Excel file xlsm dc065a0837f8c34db5ca2bad3dafe777be0c22acb15f957b712b2631adf804cc

ModiLoader

Executable exe a95c6a61523704d369aa61231c2c1ae80c1ce87911f519b4108a40306b2152ac

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/432118/
  
Dropped by
MD5 0d0bdf9cd350eaa235ed42355186a0f0
  
Dropped by
SHA256 dc065a0837f8c34db5ca2bad3dafe777be0c22acb15f957b712b2631adf804cc
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/45272/

Comments