MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d608629667423dc9313f6cf036598f62466c70ee10c21ea0ae40c1845b3eba56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d608629667423dc9313f6cf036598f62466c70ee10c21ea0ae40c1845b3eba56
SHA3-384 hash: 9914088b282d349bf547d37300fcc5c2ec606d999fd7fab5a306a1c035b80da9a02e671fbf10be53563e233865293f55
SHA1 hash: c7587d8016381a704b935e9cb4c5e9c3655d93fa
MD5 hash: 69575b19e0a7608467b7b5b84e660cb3
humanhash: xray-bacon-table-carpet
File name:Payment Copy_xls.arj
Download: download sample
Signature ModiLoader
Create hunting rule
File size:366'849 bytes
First seen:2020-10-21 10:10:53 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:k7Qe8WRfae62m15ffjEZsnSUpA2edJZQj33eUv12m+xF/yvJ4JLldnHELvZFzY1J:0QJWYX3fjE7X20E6UJvmBkzZFzwUBcDj
TLSH 7E74235D53A8E992CB7C772C73622209E34B52332AC8EF3D37B06F30A5866515F5A4D2
Reporter abuse_ch
Tags:arj ModiLoader


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: localhost
Sending IP: 89.248.168.148
From: Sylvia SuenSales & Accounting Dept. <services@plastimar.org>
Subject: Payment Process / 21.10.2020
Attachment: Payment Copy_xls.arj (contains "Payment Copy.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d608629667423dc9313f6cf036598f62466c70ee10c21ea0ae40c1845b3eba56/
Threat name:
Win32.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 09:25:59 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2yegffthii64smj7ntydmwmpmjdgy4hocdbb5ifoidayiwz6xjla._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

arj d608629667423dc9313f6cf036598f62466c70ee10c21ea0ae40c1845b3eba56

(this sample)

ModiLoader

Executable exe f8710cfad83de55ad40192f24579067fafdcf20f243114f9eac333c937125551

  
Dropping
MD5 93ffb365126a70530cf2d25744791772
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f8710cfad83de55ad40192f24579067fafdcf20f243114f9eac333c937125551

Comments