MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ab7e0b5f3918a455e9f0da684850596f30cf702cda0f6ce533b8d008d6980a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ab7e0b5f3918a455e9f0da684850596f30cf702cda0f6ce533b8d008d6980a8
SHA3-384 hash: 1266f2805e1709f72075e616da7aaae3b354025841a0b900e6ee66d59287c70f4ac89a609ca55504b17dbbced1f0ffa9
SHA1 hash: 8a14d321b4caa2b8360bf0d271374b582d540f4f
MD5 hash: 383bc13f923b0515087547dc84225dbb
humanhash: charlie-wisconsin-hotel-cold
File name:Albawardi Group Project offer description 678467463756382020.iso
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'013'760 bytes
First seen:2020-10-26 14:19:25 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:sVCTeZF541To2ztd5/IEAHqDPD3PDQnA/g07SVllWweV+8YZqckawUNlY7RzjTOp:sVCCa1Rzt0EAHqf36EFAYlujYYue
TLSH 0225AE21B7918836D1731B7A9D5B67B89E25FE102E2065473BFC688C4F76790383A2D3
Reporter abuse_ch
Tags:iso ModiLoader


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: h22.megalink.com
Sending IP: 200.75.160.22
From: Sayeed Almohtaseb <info@bidakis.com>
Subject: Re:Offer #SKTMC440 Albawardi Group
Attachment: Albawardi Group Project offer description 678467463756382020.iso (contains "Albawardi Group Project offer description 678467463756382020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6ab7e0b5f3918a455e9f0da684850596f30cf702cda0f6ce533b8d008d6980a8/
Threat name:
Win32.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 07:29:32 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nk36bnptsgfekxu7bwtijbifs3zqz5yczwqpntsthogqbdljqcua._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

iso 6ab7e0b5f3918a455e9f0da684850596f30cf702cda0f6ce533b8d008d6980a8

(this sample)

ModiLoader

Executable exe 3f6c0a695ed2c971594738b378b21b3bb936d424e4516216f34b4dff8aa063dc

  
Dropping
MD5 81863c0034547cc203cc63d833c9e7e5
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3f6c0a695ed2c971594738b378b21b3bb936d424e4516216f34b4dff8aa063dc

Comments