MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 565880d9bdfd8b75c1712932687a7938cc93492de634b0c8ed11b6dbdc7b71f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 565880d9bdfd8b75c1712932687a7938cc93492de634b0c8ed11b6dbdc7b71f7
SHA3-384 hash: 87664dea701f261702292efd57d8a0203b14e830561f822bd31ed9a6d04d701a74e5a4f9b9960cac1e69102387d598a8
SHA1 hash: 94532699c5c6effc1a350e0be0ebf1b075a05aef
MD5 hash: bd65b94a1033e7c6d1994ab208c8a472
humanhash: utah-wisconsin-monkey-pizza
File name:zaproszenie policji.iso
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'028'096 bytes
First seen:2020-10-19 13:23:28 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:iY2jsH0s30vuwlPMSGUzoPLLJ3SSsD8O1suNn5IswLOQ:izjm02wKazmLF6sO1A
TLSH B1257D32B2925873D47329789D1B67A8BD3ABE002928B5463BF91C4C5F396413C7E397
Reporter abuse_ch
Tags:geo iso ModiLoader POL


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mx1.e-tiger.net
Sending IP: 193.23.139.20
From: Policja <invitations@policja.pl>
Subject: Ostatnie zaproszenie od policji
Attachment: zaproszenie policji.iso (contains "zaproszenie policji.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Fareit-FZO47BEC7E4E109.19705.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/565880d9bdfd8b75c1712932687a7938cc93492de634b0c8ed11b6dbdc7b71f7/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 10:29:28 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kzmibwn57wfxlqlrfezgq6tzhdgjgsjn4y2lbshncg3nxxd3oh3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/565880d9bdfd8b75c1712932687a7938cc93492de634b0c8ed11b6dbdc7b71f7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

iso 565880d9bdfd8b75c1712932687a7938cc93492de634b0c8ed11b6dbdc7b71f7

(this sample)

ModiLoader

Executable exe f908e0abb7cf81d0e8f6604cf08bf71a431a409a44073a1a5c542b1987f9cadc

  
Dropping
MD5 1ef671ebe0e5efd44cf05c630fbe9cb5
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f908e0abb7cf81d0e8f6604cf08bf71a431a409a44073a1a5c542b1987f9cadc

Comments