MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23b477308bd755a8f789a5f1edc6a6a0bc9848f04f37ad67e4315f665159bb61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 23b477308bd755a8f789a5f1edc6a6a0bc9848f04f37ad67e4315f665159bb61
SHA3-384 hash: 5241cad84a7c8a7d88ca62af0a04c5c47d8c8b7370564204d79383ffa2aea33976f4ee8d8e23f69c5f84022a9a6c7102
SHA1 hash: 8ca527a47a9b7d2f34c9fce59df14a9528ad0cbd
MD5 hash: 2b379abe1892663cc0f85d071e3c022c
humanhash: kilo-april-cup-emma
File name:PO102620.gz
Download: download sample
Signature ModiLoader
Create hunting rule
File size:398'646 bytes
First seen:2020-10-27 09:22:53 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:/bCXm3GHHJcyTLTo1GCAfwC+NpAeAaEDGJeE:/bC26pcevgTNpAz7w
TLSH 9C8423F68AFE007AB09A100049E69D6FCB9D619DFE98C10FE005D44BD526E9DDED432B
Reporter abuse_ch
Tags:gz ModiLoader


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: mail-cld-x14.trdns.com
Sending IP: 77.245.147.204
From: Muge Barbaros <muge.pamukcu@bashan.com.tr>
Reply-To: cdy3079@gmail.com
Subject: Purchase Order
Attachment: PO102620.gz (contains "PO102620.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/23b477308bd755a8f789a5f1edc6a6a0bc9848f04f37ad67e4315f665159bb61/
Threat name:
Win32.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 18:51:40 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eo2homel25k2r54juxy63rvguc6jqshqj4322z7egfpwmukzxnqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

gz 23b477308bd755a8f789a5f1edc6a6a0bc9848f04f37ad67e4315f665159bb61

(this sample)

ModiLoader

Executable exe 1098c2e11043776815738d6f8abc818560c7516948d15f231a7018dfaeb279ed

  
Dropping
MD5 590d922e02ba43a79c376b22578488fb
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1098c2e11043776815738d6f8abc818560c7516948d15f231a7018dfaeb279ed

Comments