MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1938cc7b64c7de88fee64d6cbe7f44bf50f478e2de02b03ca8b5f38467c0ea6b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1938cc7b64c7de88fee64d6cbe7f44bf50f478e2de02b03ca8b5f38467c0ea6b
SHA3-384 hash: b4559ca0207fb7db94d130229e4c8680d5c3158fb18e2ee72919f96b7fe0c52aac7d9a07b9729105ff91cbb87f3097a7
SHA1 hash: 3bd44fd494cdd46a7816361e3f0f6fa6f7f85ab3
MD5 hash: 2307c57e1559fac3835cc34a49f3c66b
humanhash: india-alaska-jupiter-four
File name:PO CBV87654468.pdf.iso
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'224'704 bytes
First seen:2020-10-27 10:08:30 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:SJROS/D7RYUfXkIlC+23Oy55Wf/lJrQGo/uV9S7AlPBbrEZlgfkmHvXbCyVsQHwj:SP3taIH23P5IJRqU3rLCX9
TLSH DC458DA2A69504E6F132EA788F7746E345FDBC3138384CA536AC2D097AFF1412D5ED42
Reporter abuse_ch
Tags:iso ModiLoader


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: email.asiaepmail.com
Sending IP: 52.187.42.126
From: Ica Wulandari <sale1@mts.com.sa>
Subject: RE: Order PO CBV87654468
Attachment: PO CBV87654468.pdf.iso (contains "PO CBV87654468.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.PrivateEXEProtector4-6192998-2
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1938cc7b64c7de88fee64d6cbe7f44bf50f478e2de02b03ca8b5f38467c0ea6b/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 07:13:26 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=de4my63ey7pir7xgjvwl472ex5ipi6hc3yblapfiwxzyiz6a5jvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

iso 1938cc7b64c7de88fee64d6cbe7f44bf50f478e2de02b03ca8b5f38467c0ea6b

(this sample)

ModiLoader

Executable exe 4cc2e534b544c2bd3b2508959965c9b11f9b7c6ce341332e6aab3509af066cde

  
Dropping
MD5 67fabfbd42d3ec84fdc3cb39adda1b70
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4cc2e534b544c2bd3b2508959965c9b11f9b7c6ce341332e6aab3509af066cde

Comments