MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c11d227fbf28fb0e339d1972e038a73b8e7167ddefa78925b3471a469af03a7d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c11d227fbf28fb0e339d1972e038a73b8e7167ddefa78925b3471a469af03a7d
SHA3-384 hash: bf2abcef7811ee054dd99e8f3f26f4be7b3f6a9f115b9a1bcb572557fb5ea4dfba3b9a836006f188dcde573c4702f00f
SHA1 hash: 215a9320015f74a17e1d78baa178ca446a8149c1
MD5 hash: 5265eb7cd58938d6c1356e5ea6bec108
humanhash: twenty-maine-october-maryland
File name:file.zip
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'202'492 bytes
First seen:2020-07-31 06:29:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:GsShOhIS62308leVWRv6YrcFM3vTXElQijcKq66R+3ffVSQ5D:fShOqf2E8lWYrOyESgBn3ffwY
TLSH 654533CACD143FAC6424D691F7B95D3BABE3CED8908A8C53A21D3FC598FC928484E155
Reporter abuse_ch
Tags:geo ModiLoader THA zip


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: lhost7.websahibi.com
Sending IP: 213.142.143.189
From: servicentech@yahoo.com
Subject: Re: โปรดตรวจสอบคำสั่งซื้อใหม่ของเรา
Attachment: file.zip (contains "Dgslimt_Signed_.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25545.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25560.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c11d227fbf28fb0e339d1972e038a73b8e7167ddefa78925b3471a469af03a7d/
Threat name:
Win32.Trojan.Jacard
Create hunting rule
Status:
Malicious
First seen:
2020-07-31 02:47:08 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yeose757fd5q4m45dfzoaofhhohhcz6556tysjnti4nengxqhj6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c11d227fbf28fb0e339d1972e038a73b8e7167ddefa78925b3471a469af03a7d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip c11d227fbf28fb0e339d1972e038a73b8e7167ddefa78925b3471a469af03a7d

(this sample)

ModiLoader

Executable exe a678db2b0d3f84a7edaa2c100192a43397a7be3d2c482b34d7bdaf1572f00720

  
Dropping
MD5 738cd543912792b376d1a444c01f2a13
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a678db2b0d3f84a7edaa2c100192a43397a7be3d2c482b34d7bdaf1572f00720

Comments