MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f13d529ca2630de2bbd314359f7ac92d83acb76ff80dc169990634c1ad929b0b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f13d529ca2630de2bbd314359f7ac92d83acb76ff80dc169990634c1ad929b0b
SHA3-384 hash: 3f89e942372ba608b2cb697855e3dd5bc59ea3ab883a447d6553728f5e03f717926e57b517667ad11938e4d6f9692ea5
SHA1 hash: 67a85e7f032371897d015400b117100cc719d6e0
MD5 hash: 9f70115c79c64e462dc0dabd91904a6e
humanhash: connecticut-fix-oxygen-sierra
File name:9f70115c79c64e462dc0dabd91904a6e.exe
Download: download sample
Signature ModiLoader
Create hunting rule
File size:771'264 bytes
First seen:2020-12-14 19:58:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c3d6710a07e2881790555234ea14179a (8 x ModiLoader, 1 x Formbook, 1 x ISRStealer)
ssdeep 12288:/4Per7j2cD2/gERzL6XeF03yKnkn3Hp2EAIFOvYNmT:/VKc63GkSnioEvOqo
Threatray 7 similar samples on MalwareBazaar
TLSH 39F49F53F2904437D06716799C1B97A8AC2ABF103E349D4A6BF93D4C4F3A391782A1E7
Reporter abuse_ch
Tags:exe ModiLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
156
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9f70115c79c64e462dc0dabd91904a6e.exe
Verdict:
Suspicious activity
Analysis date:
2020-12-14 19:59:17 UTC
Tags:
installer
Link:
https://app.any.run/tasks/881e5b16-a33a-4faa-82d8-c48b9a89cb4a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/108034/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Variant.Strictor.253009.11269.9482.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Creating a file
Launching the default Windows debugger (dwwin.exe)
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/562601
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f13d529ca2630de2bbd314359f7ac92d83acb76ff80dc169990634c1ad929b0b/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-12-14 19:59:05 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6e6vfhfcmmg6fo6tcq2z66wjfwb2zn3p7ag4c2mzay2mdlmstmfq._file
Verdict:
suspicious
Similar samples:
35b67e1c875487d5d0f15b03a1fd37cfe1396d13ff47440ef7f18402f1b7131e
ModiLoader
5c755513f6bb355adb6e71b9970361b71191b987dbfa53a1fa4b79651b75fe15
ModiLoader
88b677a3b0b552141610da3b5b9a73f40e705a16cec821c73ea01a55fbf8202f
ModiLoader
8ede03b20c5b4ef52e213ef63d0470ed9a71caa0435a0a4bb4a6b95903cfdd76
ModiLoader
b4711ee19363ec125911ae1356714720a9d9b463848b1044d08d56977cb960db
ModiLoader
f8256bf4c71a315eb73feee981a5f9220dfb7196476d180b5375eb40bfbfc5b0
ModiLoader
fbde44031b8acd00f624403184405b3fcf572c220c321ec82c29e7f9c3cbc233
ModiLoader
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/201214-xy6mjjv5pn/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
f670327031fea219b14cacb0874c92a24db2016f8da175093063e472c3e8cbf6
MD5 hash:
d935ff4781629f575828309fdfd10c33
SHA1 hash:
869059ed44576a9caef56538f199152b79c4e2a1
Detections:
win_dbatloader_g0
Create hunting rule
Link:
https://www.unpac.me/results/6f641257-7bf8-466e-b41d-b2c5338928d5/
Parent samples :
00ae65a6a1579c78baf89a99da5acabd1d5c1fb1c5e8a25f5225c46b65761240
718ff9580d5cae07b3b8df0372dc9c554e5c72b55a28e68f306c47d57ac72082
5cdf035217d5c312f4c3f66b4074c9c7abd9b710c0ae1b03ec2879f3657db096
b4711ee19363ec125911ae1356714720a9d9b463848b1044d08d56977cb960db
8ede03b20c5b4ef52e213ef63d0470ed9a71caa0435a0a4bb4a6b95903cfdd76
f13d529ca2630de2bbd314359f7ac92d83acb76ff80dc169990634c1ad929b0b
556eb256ac26f32787bf8d8b54980b1ba50b93b3736683e59b26398a1f42820f
6eddee04fd3f715201359b14b2ac4c017b5c68d3059ce8cd306761fc4ee754fe
SH256 hash:
f13d529ca2630de2bbd314359f7ac92d83acb76ff80dc169990634c1ad929b0b
MD5 hash:
9f70115c79c64e462dc0dabd91904a6e
SHA1 hash:
67a85e7f032371897d015400b117100cc719d6e0
Link:
https://www.unpac.me/results/6f641257-7bf8-466e-b41d-b2c5338928d5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f13d529ca2630de2bbd314359f7ac92d83acb76ff80dc169990634c1ad929b0b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ModiLoader

Executable exe f13d529ca2630de2bbd314359f7ac92d83acb76ff80dc169990634c1ad929b0b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/898216/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/108034/

Comments