MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d954dd8aa0582c4f75e8dce834cf88f5e5e8bb3f40b4aa07687dd3b584ce210d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d954dd8aa0582c4f75e8dce834cf88f5e5e8bb3f40b4aa07687dd3b584ce210d
SHA3-384 hash: be5c3d351748f01d30dc761cd7d0d429b3161782536a80f11ac63ae42b16da52ab2a0407101d4b05d1df153e05e0c385
SHA1 hash: e16abd58f27a019f4a398f8e5fc20aab6b1101d4
MD5 hash: 89b1d9c77bcfda80747702e5dcee9519
humanhash: failed-dakota-spaghetti-beryllium
File name:LHRR003805821.zip
Download: download sample
Signature ModiLoader
Create hunting rule
File size:495'151 bytes
First seen:2020-10-05 13:21:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:qg62K6ewqUnut2+Fqiq2thtYM+euCQzxNUWB5BURqcDYaR:p6Aewtne2+FqiqCeM+eJQFfqRqhm
TLSH 77B423D936F6A1C1A32056AE20D20F80DF5F364CA8FED319EDC55AD32A34760E7B1958
Reporter abuse_ch
Tags:DHL ModiLoader zip


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: mail-out-06.forthnet.gr
Sending IP: 193.92.3.90
From: e-billing.uk1@dhl.com
Subject: Your latest DHL invoice : LHRR003805821
Attachment: LHRR003805821.zip (contains "LHRR003805821.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d954dd8aa0582c4f75e8dce834cf88f5e5e8bb3f40b4aa07687dd3b584ce210d/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 12:33:54 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3fkn3cvalawe65pi3tudjt4i6xs6roz7ic2kub3ipxj3lbgoeegq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d954dd8aa0582c4f75e8dce834cf88f5e5e8bb3f40b4aa07687dd3b584ce210d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip d954dd8aa0582c4f75e8dce834cf88f5e5e8bb3f40b4aa07687dd3b584ce210d

(this sample)

ModiLoader

Executable exe 0444972f4976d21a707c947f936ee857584f0dee44e795c6dc7cb86d9b28eddd

  
Dropping
MD5 b910508f0f4f13119ca36d5b557ac22c
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0444972f4976d21a707c947f936ee857584f0dee44e795c6dc7cb86d9b28eddd

Comments