MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1cd2236882518804c7099448580786bfbdc65e11651c9771a9aac573c19f53a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1cd2236882518804c7099448580786bfbdc65e11651c9771a9aac573c19f53a
SHA3-384 hash: 11a7a83f34705b45326e988f3b5d0f28f67918f0ecdd849065f91107a558efde41feee0991d35a7df6f38dac18992532
SHA1 hash: ee9ef21ee736837cb6b680b473e2e9a7ce68e4c7
MD5 hash: 1b71dab6a21e877a1a0567c42d65de51
humanhash: fourteen-winter-harry-monkey
File name:Payment_details 1.rar
Download: download sample
Signature ModiLoader
Create hunting rule
File size:464'286 bytes
First seen:2020-07-22 08:50:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:f2lHX3vCJEuTj8BSVHf/H/8bglVoe0ZrDq5SAdR:O9iH8BSVHHH/8SGe6rDpAL
TLSH E0A423BA761C7722B13542AD83BC96830F4014BD47B65D900EC80A6985BEEDDE2FD4B7
Reporter abuse_ch
Tags:ModiLoader rar


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: shbc10.ultina.jp
Sending IP: 218.40.207.10
From: accounts <accounts@seagoldlog.com>
Subject: RE: Payment delayed due to situation COVID-19
Attachment: Payment_details 1.rar (contains "Payment_details.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a1cd2236882518804c7099448580786bfbdc65e11651c9771a9aac573c19f53a/
Threat name:
Win32.Trojan.Zusy
Create hunting rule
Status:
Suspicious
First seen:
2020-07-22 08:52:08 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uhgsenuieumiatdqtfciladynp55yzpbczi4s5y2tkwfopaz6u5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a1cd2236882518804c7099448580786bfbdc65e11651c9771a9aac573c19f53a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

rar a1cd2236882518804c7099448580786bfbdc65e11651c9771a9aac573c19f53a

(this sample)

ModiLoader

Executable exe b0a98ae8b1dadc3b181f6252abef59940ceeb5019cd4ae2f0feadb0a520063cd

  
Dropping
MD5 f2e67ddfc74c987018aa9438dd0f9ddd
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b0a98ae8b1dadc3b181f6252abef59940ceeb5019cd4ae2f0feadb0a520063cd

Comments