MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b0464d4a5b52164034626ba76f7f7b1f88a37365a563279b87c9a2e5d96e61c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b0464d4a5b52164034626ba76f7f7b1f88a37365a563279b87c9a2e5d96e61c
SHA3-384 hash: 05c8be2b21d46a81add590e4222a895ba999a86fdfe847c8fe1a62a4d502228677e48a20410b3438e0013babdd54b25d
SHA1 hash: eeca84f66731d6d1dcabb07b9bcedc4ab6378a54
MD5 hash: 8a7cd11668f8be1a665414bfac3c7ae2
humanhash: mike-california-don-failed
File name:File_details.iso
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'638'400 bytes
First seen:2020-10-16 10:23:25 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:kFT7lBs40jT0sUbtpW/nAOPq3Sp585n7nLT6USE/7LYUx5t8SH1:kvBsxTEi5Q7nLT6USE/7kUPt
TLSH 9B75CF31F3E2CA36F25611318C2B57B9A532BE002924945A76EA3C4D9F367F079792D3
Reporter abuse_ch
Tags:iso ModiLoader UPS


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: hardcore-gould.52-165-237-63.plesk.page
Sending IP: 40.77.27.88
From: UPS Customer Service <customer@ups.com>
Subject: UPS - Pending delivery
Attachment: File_details.iso (contains "Tgdzbcw_Signed_.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis5F81083596A0.8651.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6b0464d4a5b52164034626ba76f7f7b1f88a37365a563279b87c9a2e5d96e61c/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 18:55:12 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nmcgjvffwuqwia2ge25hn57xwh4iunzwljlde6nypsnc4xmw4yoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6b0464d4a5b52164034626ba76f7f7b1f88a37365a563279b87c9a2e5d96e61c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

iso 6b0464d4a5b52164034626ba76f7f7b1f88a37365a563279b87c9a2e5d96e61c

(this sample)

ModiLoader

Executable exe cb8095a08ad64a6811cfb011db6f7bc97f21e459ca65382251bec95cfd1d9529

  
Dropping
MD5 afdf2f3253c6d08b717e7b9e99033e11
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cb8095a08ad64a6811cfb011db6f7bc97f21e459ca65382251bec95cfd1d9529

Comments