MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87118b6ec9d961ec0d6507868c974be9f74795479e6325cf8837c0916d013c34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87118b6ec9d961ec0d6507868c974be9f74795479e6325cf8837c0916d013c34
SHA3-384 hash: 63713291ced9753033aa6a6ce07b5592332944ef962392127e2fcb7e3a85e23130e2cd1676c776e3b46b53b8fd5d54d1
SHA1 hash: f7244ffd1b78eaf66eb6d6ae8e3a7abc240e1020
MD5 hash: 378537e9488dd3f336df2bea731deb3e
humanhash: video-friend-lake-mike
File name:Re Purchase Order-23.01.2023.r05
Download: download sample
Signature ModiLoader
Create hunting rule
File size:277'303 bytes
First seen:2023-01-25 08:37:02 UTC
Last seen:2023-01-25 09:34:42 UTC
File type: r05
MIME type:application/x-rar
ssdeep 6144:0g1NMXT+ipiKU/jD92jSXpkX/BTz2GrycGGr:xEpfs92jSXevBTz5aGr
TLSH T1434423B3E5F2E7082E1B46E4F1F191474A7630CEE7EB1644BB38525631A9028DD4D0BE
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:ModiLoader r05


Avatar
cocaman
Malicious email (T1566.001)
From: "=?UTF-8?B?UGF2ZWwgVmHFocOtxI1law==?= <Pavel.Vasicek@bmt.cz>" (likely spoofed)
Received: "from [83.229.85.54] (unknown [83.229.85.54]) "
Date: "24 Jan 2023 21:43:08 +0200"
Subject: "Re: Purchase Order-23.01.2023"
Attachment: "Re Purchase Order-23.01.2023.r05"

Intelligence

File Origin
# of uploads :
45
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
keylogger
Link:
https://www.filescan.io/uploads/63d0ea341c9cbf7d62527fe6/reports/b1e8841a-b14b-4c48-834f-70aa8e344942/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/87118b6ec9d961ec0d6507868c974be9f74795479e6325cf8837c0916d013c34/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2023-01-24 09:30:12 UTC
File Type:
Binary (Archive)
Extracted files:
57
AV detection:
27 of 39 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q4iyw3wj3fq6ydlfa6dizf2l5h3upfkhtzrslt4ig7ajc3ibhq2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DBatLoader
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/87118b6ec9d961ec0d6507868c974be9f74795479e6325cf8837c0916d013c34

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

r05 87118b6ec9d961ec0d6507868c974be9f74795479e6325cf8837c0916d013c34

(this sample)

RemcosRAT

Executable exe c266fa606a35b4ede65ae441e448dfcbf63b7a4e52091be0a6dc013b3e93c1f8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c266fa606a35b4ede65ae441e448dfcbf63b7a4e52091be0a6dc013b3e93c1f8
  
Dropping
ModiLoader

Comments