MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53087e70f2b3875dd24b3575adfbb19d07aea6849ae4524980e976f580a116e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53087e70f2b3875dd24b3575adfbb19d07aea6849ae4524980e976f580a116e5
SHA3-384 hash: 1008beacf30378880046c70d74a7c365a322159b455d3ef3b56dfecf9e6a0c97b806b6a579863c81cb771ae60432477b
SHA1 hash: d48809754a72e9f964479795ae7726476c61bff3
MD5 hash: fd87c7727302d916b96175d4d2153db8
humanhash: solar-oklahoma-video-east
File name:ESTRATTO CONTO DHL-1301383112.iso
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'284'096 bytes
First seen:2020-10-08 17:41:21 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:rpP5SyQ9wblP2AB469py931hFrPRDfI4xZLx7kX8wp0vx7yUD0+:rpR26vZy93NpTjxjkMwp0
TLSH 9D556D12B251CC36C1E22A749C4FC2B89926BE403D27A94736E83F4DBF797513939297
Reporter abuse_ch
Tags:iso ModiLoader


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: cloudhost-1457425.us-midwest-1.nxcli.net
Sending IP: 8.29.157.202
From: InvoiceQuery@dhl.com
Subject: ESTRATTO CONTO DHL-1301383112
Attachment: ESTRATTO CONTO DHL-1301383112.iso (contains "ESTRATTO CONTO DHL-1301383112.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/53087e70f2b3875dd24b3575adfbb19d07aea6849ae4524980e976f580a116e5/
Threat name:
Win32.Trojan.RemcosCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 15:01:13 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kmeh44hswodv3uslgv22365rtud25juetlsfesma5f3plafbc3sq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/53087e70f2b3875dd24b3575adfbb19d07aea6849ae4524980e976f580a116e5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

iso 53087e70f2b3875dd24b3575adfbb19d07aea6849ae4524980e976f580a116e5

(this sample)

ModiLoader

Executable exe a798d4bc2652e8509948c52670f34f2e59149cb2aefc60e486f014ffa112771f

  
Dropping
MD5 234c7ed18a7ea1b5ada06bad5388cf3f
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a798d4bc2652e8509948c52670f34f2e59149cb2aefc60e486f014ffa112771f

Comments