MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00406b2860c654934e60caf73818bf20d19465583b437471df4095c75ad6af7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 00406b2860c654934e60caf73818bf20d19465583b437471df4095c75ad6af7b
SHA3-384 hash: 000fe6a2a0897f835a9d66deecdcc6cd7deadff14f340f59f1af3c52ae794b7dd368b74fd7cdba617fe6856ce235d148
SHA1 hash: 8d6a490ea064409f5c2c1c4ee6574245267af7a9
MD5 hash: eba6164d9a3a9dfec186d0e53b240d73
humanhash: illinois-paris-angel-muppet
File name:DHL_677233.IMG
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'638'400 bytes
First seen:2020-11-06 17:23:17 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:ZuQSAIeXjs8BQPtd+TuaCzhnycIZTtkO1y2QSTgKRwoaQtkljsWF/sWF9s:cRMj/BQPSTuVByrth1pQSMIwoh8
TLSH 30759EA2A680D432D09315B94D5BDBFC7839BEA03D24580B77D8DE0C5F3A781B53A25B
Reporter abuse_ch
Tags:DHL img ModiLoader


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: jovial-wilbur.52-162-254-219.plesk.page
Sending IP: 23.100.79.202
From: DHL <support@dhl.com>
Subject: Your AWB Shipment Has Arrived
Attachment: DHL_677233.IMG (contains "DHL_677233.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/00406b2860c654934e60caf73818bf20d19465583b437471df4095c75ad6af7b/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 10:20:27 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=abagwkdayzkjgttazl3tqgf7edizizkyhnbxi4o7ick4owwwv55q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

img 00406b2860c654934e60caf73818bf20d19465583b437471df4095c75ad6af7b

(this sample)

ModiLoader

Executable exe dd90203d2caab14ccfb48f6fbb2c15b956b07c72395b671e06b68049c90ceb25

  
Dropping
MD5 1e59a2c8298846c08aa900f05b18062f
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dd90203d2caab14ccfb48f6fbb2c15b956b07c72395b671e06b68049c90ceb25

Comments