MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99a05067aed94f735dd04aed200cf020a0e2276791c44692491a895007c9dc64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 99a05067aed94f735dd04aed200cf020a0e2276791c44692491a895007c9dc64
SHA3-384 hash: 074092af17227725c216d08cfb33e96b9b71fa3532c8570bbae86a2f4dfed5d734f993dfc2ab4435f0d0381f74d274f0
SHA1 hash: d4bf8cf0686f965284dcea67b77b991900fc35c0
MD5 hash: 0654693d77996bb94e89a11278d0183c
humanhash: finch-summer-march-yankee
File name:New Order.lz
Download: download sample
Signature ModiLoader
Create hunting rule
File size:226'255 bytes
First seen:2020-08-31 11:28:13 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:gg2u8dAbfSU1TZ2+QOeVilXdIJciyIwIKEARZwm:gRu8qbZ1NEilN5iyfIKVRZJ
TLSH 142423670DF1709FD6AB5789905E8698B702BC3B5123E4487B4F2BA603B6C3431BED61
Reporter abuse_ch
Tags:lz ModiLoader


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: espanol.accesscam.org
Sending IP: 192.119.94.165
From: Grace A Frankly <sales@progate.top>
Subject: New Order
Attachment: New Order.lz (contains "New Order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/99a05067aed94f735dd04aed200cf020a0e2276791c44692491a895007c9dc64/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 04:44:17 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tgqfaz5o3fhxgxoqjlwsadhqecqoej3hshcenesjdkevab6j3rsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/99a05067aed94f735dd04aed200cf020a0e2276791c44692491a895007c9dc64

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

rar 99a05067aed94f735dd04aed200cf020a0e2276791c44692491a895007c9dc64

(this sample)

ModiLoader

Executable exe 4d1b436558291aa226a7342db8ff207bce093a7b329e10843101e7bf9974ea49

  
Dropping
MD5 28fa86ac13b13057063f65ba9335d61f
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4d1b436558291aa226a7342db8ff207bce093a7b329e10843101e7bf9974ea49

Comments