MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bafb32b601e639da49a36444b8cf18f5ee9f0033584a2976f4126391ac1e61a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bafb32b601e639da49a36444b8cf18f5ee9f0033584a2976f4126391ac1e61a2
SHA3-384 hash: fc8bd0657d2282a6c27bde3b9aeaef5c25bf652046ae15bf2bab570fc1422213ba64c1bb1c792057c3bbabd81f4c3049
SHA1 hash: 37d293ac632c4369859c7dfe9fbea1a9a84720bb
MD5 hash: a915006a1be0167e63311ae5fc795a8b
humanhash: september-friend-avocado-ink
File name:PO_061120-TVOP8756625443446277,pdf.iso
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'589'248 bytes
First seen:2020-11-07 10:20:01 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:Tv1VZBy9ivPzx9cNGqi8h+gcf5BY4KCoHd:TvffZgh+gcPY4fcd
TLSH FF75CFA2A2814632C57329384F1F6BE7593E7E282E6465122AF46C4CBF377C13535E87
Reporter abuse_ch
Tags:Endurance iso ModiLoader


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: gateway22.websitewelcome.com
Sending IP: 192.185.46.187
From: C.B.M. S.r.l. <sales1@cbm-srl.com>
Subject: C.B.M. PO_061120-TVOP8756625443446277
Attachment: PO_061120-TVOP8756625443446277,pdf.iso (contains "PO_061120-TVOP8756625443446277,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Pecompact-73
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bafb32b601e639da49a36444b8cf18f5ee9f0033584a2976f4126391ac1e61a2/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 02:02:01 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xl5tfnqb4y45usndmrclrtyy6xxj6abtlbfcs5xucjrzdla6mgra._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

iso bafb32b601e639da49a36444b8cf18f5ee9f0033584a2976f4126391ac1e61a2

(this sample)

ModiLoader

Executable exe d41793ad3f14231055a7cad6bc94b4ff361d93a3c6a752c7173d2e71898014eb

  
Dropping
MD5 0c5423b308ab9ee14de018450e88a2e5
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d41793ad3f14231055a7cad6bc94b4ff361d93a3c6a752c7173d2e71898014eb

Comments