MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68690c3e7bb9fa657bb88632419dcbda0d1b9bdd92d92b8939b04c1b670c3046. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68690c3e7bb9fa657bb88632419dcbda0d1b9bdd92d92b8939b04c1b670c3046
SHA3-384 hash: a039477e7c0fac78c13305b746ad6e33b0bf06077cbaa3efa7bfb425d66a69114c7cec5bb5a85a4ee29f120c400ad248
SHA1 hash: 4bab86f2e7d1321765e7cdd1bb31fc6197484ada
MD5 hash: 3caa540edcd421e84607d04d26635492
humanhash: jupiter-robert-river-seventeen
File name:PROFORMA Updt NR.119220_REV_3 Copies IMG_00002892.r01
Download: download sample
Signature ModiLoader
Create hunting rule
File size:465'423 bytes
First seen:2020-10-23 06:58:52 UTC
Last seen:Never
File type: r01
MIME type:application/x-rar
ssdeep 12288:4ZGnxh8lEChq581bLB0soLdsCsQgW0MqaESA8l:4ZGxWlpqu1Ba//qaESA4
TLSH CFA42369FF55329673A36992745548248826F8C22236F391FBCA0368BF48777325F0CD
Reporter abuse_ch
Tags:ModiLoader r01


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: starmix.it
Sending IP: 185.222.57.249
From: Anna - Starmix <anna.poletto@starmix.it>
Subject: R: PROFORMA NR.1192/20_REV_3 _Corrected
Attachment: PROFORMA Updt NR.119220_REV_3 Copies IMG_00002892.r01 (contains "PROFORMA Updt NR.119220_REV_3 Copies IMG_00002892.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/68690c3e7bb9fa657bb88632419dcbda0d1b9bdd92d92b8939b04c1b670c3046/
Threat name:
Win32.Trojan.NetWired
Create hunting rule
Status:
Malicious
First seen:
2020-10-23 04:24:58 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nbuqypt3xh5gk65yqyzedhol3igrxg65slmsxcjzwbgbwzymgbda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/68690c3e7bb9fa657bb88632419dcbda0d1b9bdd92d92b8939b04c1b670c3046

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

r01 68690c3e7bb9fa657bb88632419dcbda0d1b9bdd92d92b8939b04c1b670c3046

(this sample)

ModiLoader

Executable exe 82b070a42d50b8e37b551543e041933140f3823138b0997fccd4ad926df8183b

  
Dropping
MD5 77e35a460055d2f7501f8e0ddbad020f
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 82b070a42d50b8e37b551543e041933140f3823138b0997fccd4ad926df8183b

Comments