MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8b30a9f515a5568cc22aca8057a1923440516345a926e027baf3906615ce105. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c8b30a9f515a5568cc22aca8057a1923440516345a926e027baf3906615ce105
SHA3-384 hash: a7f62558fce866abc3a8bc83dd94647d34a75770677f377f497a8285bf4629f454b3e896fa590afa281133c2f3d3f55f
SHA1 hash: ae4d195c556f85e22a7eb0bd902ab15bcc23cd4a
MD5 hash: 06b218252817caf2d8b38e106de4cab4
humanhash: table-pip-sink-delta
File name:docs094.exe
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'319'768 bytes
First seen:2020-10-09 06:25:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7d3e89b16ba0d66bb1ffb3848ff742e0 (4 x ModiLoader, 1 x RemcosRAT)
ssdeep 12288:vonlgoDygsQFgvMGgxZpjKvtg+7agQNVTIR+Fixf0McyUC3jhpny2L:volgVfZvMhQRxW0Vbzy8
Threatray 1'076 similar samples on MalwareBazaar
TLSH 13558E12B281DC36D1E21E39DD1BC6B8D926BE406D27A48737E43F4DBF353513A1A292
Reporter abuse_ch
Tags:exe ModiLoader


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: smtp80.iad3a.emailsrvr.com
Sending IP: 173.203.187.80
From: Diego <diego@ramz.com.mx>
Subject: orden de compra
Attachment: docs094.zip (contains "docs094.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/69433/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Launching a process
Running batch commands
Creating a process with a hidden window
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Deleting a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Setting a global event handler for the keyboard
Connection attempt to an infection source
Unauthorized injection to a system process
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/486333
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates a thread in another existing process (thread injection)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Fodhelper UAC Bypass
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 295617 Sample: docs094.exe Startdate: 09/10/2020 Architecture: WINDOWS Score: 100 38 style.ptbagasps.co.id 2->38 54 Antivirus / Scanner detection for submitted sample 2->54 56 Multi AV Scanner detection for submitted file 2->56 58 Sigma detected: Fodhelper UAC Bypass 2->58 60 Machine Learning detection for sample 2->60 9 docs094.exe 1 15 2->9         started        14 Dhhrnek.exe 13 2->14         started        16 Dhhrnek.exe 13 2->16         started        signatures3 process4 dnsIp5 42 cdn.discordapp.com 162.159.133.233, 443, 49725 CLOUDFLARENETUS United States 9->42 44 discord.com 162.159.138.232, 443, 49722, 49724 CLOUDFLARENETUS United States 9->44 36 C:\Users\user\AppData\Local\...\Dhhrnek.exe, PE32 9->36 dropped 62 Writes to foreign memory regions 9->62 64 Allocates memory in foreign processes 9->64 66 Creates a thread in another existing process (thread injection) 9->66 68 Injects a PE file into a foreign processes 9->68 18 notepad.exe 4 9->18         started        21 ieinstal.exe 2 3 9->21         started        46 162.159.134.233, 443, 49755, 49761 CLOUDFLARENETUS United States 14->46 48 162.159.136.232, 443, 49752, 49753 CLOUDFLARENETUS United States 14->48 70 Antivirus detection for dropped file 14->70 72 Multi AV Scanner detection for dropped file 14->72 74 Machine Learning detection for dropped file 14->74 50 162.159.137.232, 443, 49759, 49760 CLOUDFLARENETUS United States 16->50 52 192.168.2.1 unknown unknown 16->52 file6 signatures7 process8 dnsIp9 34 C:\Users\Public34atso.bat, ASCII 18->34 dropped 24 cmd.exe 1 18->24         started        26 cmd.exe 1 18->26         started        40 style.ptbagasps.co.id 193.218.118.190, 42020 EPINATURAUA Ukraine 21->40 file10 process11 process12 28 conhost.exe 24->28         started        30 reg.exe 1 1 24->30         started        32 conhost.exe 26->32         started       
Detection:
dbatloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c8b30a9f515a5568cc22aca8057a1923440516345a926e027baf3906615ce105/
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 01:44:27 UTC
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zczqvh2rljkwrtbcvsuak6qzencakfrulkjg4at3v44qmyk44ecq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
37c2608ad09b3f6d0cd33476b8f6bf6fefd1a0f2408657072da80a0454da7e6f
ModiLoader
53136d19559089e0674af4ad81621b99a031741edcc486eb3d402fd180b1b77e
ModiLoader
54cdc9b1ede5661104e61f012de44e010500744c2b3003a6ffaff2f3f6eded34
ModiLoader
7a7eae36a54dada555db57bd8f24e4a38a9b0f0432e13d19b16b538deb5e4142
ModiLoader
96359e31d13a327a3d1de808c5420193be3691628da4f409d8d5ed14be35b038
ModiLoader
a1c561c21720c4f1c3626276db6afc2c12b1aae9304c78518763eb78454f84b8
ModiLoader
c2109f44d6d608cb821ea28489e75dbf7c7c18731918f8171bab7445db6e8599
ModiLoader
c86bcfe4e22cb50054b44e38fc4fb79624c4ed5bf9a26174754dbb5c1a6baff8
ModiLoader
daca967edea399a394a8fc24d5ee647d95dc6dadd9dd21e2945ae7a742b3aed8
ModiLoader
deeeb57609c406b43e7e77a38726a357ab063d110c06e4f1c56eb491c20659ce
ModiLoader
+ 1'066 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
persistence trojan family:modiloader
Link:
https://tria.ge/reports/201009-vcswnb7jve/
Behaviour
Modifies registry key
Modifies system certificate store
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Adds Run key to start application
ModiLoader First Stage
ModiLoader, DBatLoader
Unpacked files
SH256 hash:
f471038cc11ba18a9a63692f4ff806e1daf094e53c965ec28bc817d475ff6b94
MD5 hash:
d34e4b4b2ec25f57dc08bc2f3793affe
SHA1 hash:
aa8ca071112a031310d88164508225a575252620
Detections:
win_dbatloader_g0
Create hunting rule
win_dbatloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/d2818daa-0305-4d69-88f4-0268e625644e/
SH256 hash:
c8b30a9f515a5568cc22aca8057a1923440516345a926e027baf3906615ce105
MD5 hash:
06b218252817caf2d8b38e106de4cab4
SHA1 hash:
ae4d195c556f85e22a7eb0bd902ab15bcc23cd4a
Link:
https://www.unpac.me/results/d2818daa-0305-4d69-88f4-0268e625644e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c8b30a9f515a5568cc22aca8057a1923440516345a926e027baf3906615ce105

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_dbatloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_dbatloader_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Description:targets loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip 2d6a15a34d55bbe08a07d0eebc03e3b204f65c82710a7c3814cff7dc7067dcf0

ModiLoader

Executable exe c8b30a9f515a5568cc22aca8057a1923440516345a926e027baf3906615ce105

(this sample)

  
Dropped by
MD5 24fdb0b5fe04f2dc044255350effbb23
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/69433/
  
Dropped by
SHA256 2d6a15a34d55bbe08a07d0eebc03e3b204f65c82710a7c3814cff7dc7067dcf0

Comments