MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 10cf748693a03e95d4f2efab81757ec3ad3905129e84b7dc8c491d9e5fbb550e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 6
| SHA256 hash: | 10cf748693a03e95d4f2efab81757ec3ad3905129e84b7dc8c491d9e5fbb550e |
|---|---|
| SHA3-384 hash: | a5e379567977f06563584fb1f84d9747c696e631563b608fea9016f936bcfa8b76160334617785308fc99a2e6a1b111f |
| SHA1 hash: | b23060ce2583c89a4ab5bc690e3a7facab8912e9 |
| MD5 hash: | 2c7c0d6d1c2980b395f79bb37350ca01 |
| humanhash: | quebec-comet-west-wolfram |
| File name: | Order Inquiry 2020067-POD Engineering.scr |
| Download: | download sample |
| File size: | 1'255'424 bytes |
| First seen: | 2020-06-11 06:23:20 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 70411d486e9bd9bdaaf2d4939bbd54bc (1 x NetWire, 1 x FormBook) |
| ssdeep | 24576:iaXcbtJOhBn2j4byGtIW3ngjlZoooooooooooooooo:iaXqO2sbyVxZoooooooooooooooo |
| Threatray | 75 similar samples on MalwareBazaar |
| TLSH | 9B456C22B7914C33C1331A3DDC5B9679E82ABE511A24A8C62BF83D789F75341392D1B7 |
| Reporter |  abuse_ch |
| Tags: | scr |
abuse_ch
Malspam distributing unidentified malware:HELO: mail.etclbd.com
Sending IP: 27.147.151.99
From: POD Engineering & Trading <yumi.tan@podengineering.com.sg>
Subject: Order Inquiry 2020067-POD Engineering
Attachment: Order Inquiry 2020067-POD Engineering.img (contains "Order Inquiry 2020067-POD Engineering.scr")
Intelligence
File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Remcos
Detection(s):
Gathering data
Threat name:
Win32.Backdoor.Remcos
Status:
Malicious
First seen:
2020-06-11 06:25:10 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 65 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Score:
10/10
Tags:
family:modiloader
Behaviour
Suspicious use of WriteProcessMemory
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe 10cf748693a03e95d4f2efab81757ec3ad3905129e84b7dc8c491d9e5fbb550e
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.