MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4c2e6e3546e7169f32d5cec6adfb7bf6b7b1f1e5856aa30578f21ea52242fa2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4c2e6e3546e7169f32d5cec6adfb7bf6b7b1f1e5856aa30578f21ea52242fa2
SHA3-384 hash: ee59de121ec77818dc1f2bccdeeb543fe2f52c325a247d9fe267c223647b272e56cf635ea53a39d1b2b35132aa2eee38
SHA1 hash: 20fe7dca5e155c43b1de045ca57bbbec39811d40
MD5 hash: 7054afcd4f5f93f7bb390753b175b5dd
humanhash: fruit-stairway-maryland-uranus
File name:PO-1027.gz
Download: download sample
Signature ModiLoader
Create hunting rule
File size:494'856 bytes
First seen:2020-10-28 06:46:46 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:LvuFd7OjqL3yk64GM5vIQLVMRmpistvtvZ/4zJPpGG:LvuFpgI16XM5vIoVMRmpiah4zJPJ
TLSH 00B423F4C293FCD0F46E55A23839FA2EA6D1BCD5A01E8A25980E251397C4477467923F
Reporter abuse_ch
Tags:gz ModiLoader


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: server.kartusburada.com
Sending IP: 94.138.204.6
From: OZEN Yasin<muhasebe@akbilkereste.com.tr>
Reply-To: cdy3079@gmail.com
Subject: Purchase Order
Attachment: PO-1027.gz (contains "PO-1027.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b4c2e6e3546e7169f32d5cec6adfb7bf6b7b1f1e5856aa30578f21ea52242fa2/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-10-28 06:48:04 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wtbony2unzywt4znltwgvx5xx5vxwhy6lblkumcxr4q6uuref6ra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b4c2e6e3546e7169f32d5cec6adfb7bf6b7b1f1e5856aa30578f21ea52242fa2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

gz b4c2e6e3546e7169f32d5cec6adfb7bf6b7b1f1e5856aa30578f21ea52242fa2

(this sample)

ModiLoader

Executable exe 03a2c05c408ace3acc2aafa073fe3c1168366c43878e8839f9164827794f1a8f

  
Dropping
MD5 daa3b3c34072f25ae46c5d60ce433372
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 03a2c05c408ace3acc2aafa073fe3c1168366c43878e8839f9164827794f1a8f

Comments