MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da1143ed1481ff1759194a2b8fe6f6897de624d926730779fc12c3b7686d559c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da1143ed1481ff1759194a2b8fe6f6897de624d926730779fc12c3b7686d559c
SHA3-384 hash: 836b4f2118c05444b19fbe96b1481238ed94599454ff7ca6f89020a49adaf490a5ea09018aa9e933fb3724ee27133b6c
SHA1 hash: 08e68b312b38d801f4b2eeb7e2acdcd2c12befb0
MD5 hash: da1431521817166739fc7188f992a2f8
humanhash: blue-earth-fourteen-green
File name:4mdmiys_Signed_pdf.img
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'966'080 bytes
First seen:2020-10-09 15:41:44 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:oonlgoDygsQFgvMGgxZpjKvtg+7agQNVTIR+Qixf0BrdcyULy3jhpny2:oolgVfZvMhQRxW0Q69zy
TLSH 65953912B2C18CF6D1F219399F16F2E8952DBE405D27AC473EE43A0DBE35251363629E
Reporter abuse_ch
Tags:ARE geo img ModiLoader


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: host8.axxesslocal.co.za
Sending IP: 154.0.175.45
From: CCAvenue payment solutions <customerservice@ccavenue.ae>
Subject: UAE12321- رمز تسجيل دفع المرسل - CCAvenue Payment solutions
Attachment: 4mdmiys_Signed_pdf.img (contains "4mdmiys_Signed_.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/da1143ed1481ff1759194a2b8fe6f6897de624d926730779fc12c3b7686d559c/
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 13:48:10 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3iiuh3iuqh7rowizjivy7zxwrf66mjgzezzqo6p4clb3o2dnkwoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/da1143ed1481ff1759194a2b8fe6f6897de624d926730779fc12c3b7686d559c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

img da1143ed1481ff1759194a2b8fe6f6897de624d926730779fc12c3b7686d559c

(this sample)

ModiLoader

Executable exe 9b60c965a1425ff01954ce6a917cb4486d5af5cb36f538233139042ea324a64e

  
Dropping
MD5 52e7e1291dab1a55f22d15412aad74a6
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9b60c965a1425ff01954ce6a917cb4486d5af5cb36f538233139042ea324a64e

Comments