MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1109dad306144b1d0b0199e626a581f3c0f0b129b1010c747e81923de133acf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1109dad306144b1d0b0199e626a581f3c0f0b129b1010c747e81923de133acf
SHA3-384 hash: d13f2ea24e3ea08760ae4c9343fce3ad57b572291222f6ca3086bbc205464e55748b0ace05cfcd099739f6bc73f8c82e
SHA1 hash: e1183f8495339686adc5090ef8a2421b7fab89a9
MD5 hash: 3dc1d90fd5495800ae3d0f7f5e665675
humanhash: finch-oscar-lamp-pasta
File name:PRO FORMA INVOICE - - MAGAUTKCP 24-Nov-20.iso
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'271'808 bytes
First seen:2020-11-28 09:28:14 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:BRVtvQ+csIDccuZGhe1ppCmfwybRm8zQKtALblKCeNRbO+:BR/ovVcOM1pJwYFzQ0
TLSH 2C45CF23B1B28476C12175BEAE1B41EE6FB5FD6034B8750E37E4690C8F3AAC16D25193
Reporter abuse_ch
Tags:iso ModiLoader


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 185-86-106-187.pool.ovpn.com
Sending IP: 185.86.106.187
From: Deng Fen <sales@ecoloqicfurniture.com>
Reply-To: Deng Fen<sales@ecoloqicfurniture.com>
Subject: RE:Inquiry for November shipment #24777081
Attachment: PRO FORMA INVOICE - - MAGAUTKCP 24-Nov-20.iso (contains "PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
190
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c1109dad306144b1d0b0199e626a581f3c0f0b129b1010c747e81923de133acf/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-11-28 09:29:04 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yeij3ljqmfcldufqdgpge2syd46a6cystmibbr2h5amshxqthlhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

iso c1109dad306144b1d0b0199e626a581f3c0f0b129b1010c747e81923de133acf

(this sample)

ModiLoader

Executable exe 042ef647920e37e8da471c1bfbc36490ee6bf93ceee75cd90161823ae74d458b

  
Dropping
MD5 b3cb5b2bc5c3033b1008ed7f7f6312db
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 042ef647920e37e8da471c1bfbc36490ee6bf93ceee75cd90161823ae74d458b

Comments