MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a38ca6a619c6befb1d262caa56c00206d765af4cdfcf107f69bae3ebd0ab32e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a38ca6a619c6befb1d262caa56c00206d765af4cdfcf107f69bae3ebd0ab32e
SHA3-384 hash: b413ab0cc057355761882d090c89c6f763039817c49b38b6cb1d7bc49d0a928c2b8ff113353063af708a1c185cddcb33
SHA1 hash: 4cbdb963ff7d6acdd178840f2bfa687f6ee61264
MD5 hash: 43abee0831bf74aed4c3d5cd1b611416
humanhash: tennessee-carpet-king-sweet
File name:USD55,260.84_Payment_advice_note_from_20.11.2020.iso
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'409'024 bytes
First seen:2020-11-20 06:48:08 UTC
Last seen:2020-11-20 07:16:16 UTC
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:QVggyMBuni3KmeVXHY7hiBrGNLYragKkTZxUScffBxsqPerMmzZC3N4Sr5RPEwdO:Q5uWVLYLnURxsqPerMmzZC3N4Sr5RPEO
TLSH B165AF53F6428C3BD223093CBC5B976465267E163E2C85167BFD4E4C4B2A2822CDF997
Reporter cocaman
Tags:HSBC iso ModiLoader


Avatar
cocaman
Malicious email (T1566.001)
From: ""Annabel Weiss - Financial dept HSBC"<treybd@gmail.com>" (likely spoofed)
Received: "from smtp4 (unknown [52.252.101.133]) "
Date: "Thu, 19 Nov 2020 22:56:50 -0800"
Subject: "Fwd: Payment Advice Note dt. 20.11.2020"
Attachment: "USD55,260.84_Payment_advice_note_from_20.11.2020.iso"

Intelligence

File Origin
# of uploads :
2
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3a38ca6a619c6befb1d262caa56c00206d765af4cdfcf107f69bae3ebd0ab32e/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hi4mu2tbtrv67mosmlfkk3aaebwxmwxuzx6pcb7wtoxd5pikwmxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

iso 3a38ca6a619c6befb1d262caa56c00206d765af4cdfcf107f69bae3ebd0ab32e

(this sample)

ModiLoader

Executable exe 21b054a3b319b950887eff329ebb237a5d442e6742e94d66d2ff17cd85f8d930

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 21b054a3b319b950887eff329ebb237a5d442e6742e94d66d2ff17cd85f8d930
  
Dropping
ModiLoader

Comments