MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f68c16489fceb172402735c363f05014468f6ac5b747895bbaf4134ceaa2a920. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f68c16489fceb172402735c363f05014468f6ac5b747895bbaf4134ceaa2a920
SHA3-384 hash: f86922fc6296811019023445390dddbac125c9c8f90eb9ab6be693602e4d8b43147a91ee28678196d05b1592755135a4
SHA1 hash: 26abe43f53f9cac935190359a2bd0aa33d831ddd
MD5 hash: 35814265e42e6a7d19909f0f84348330
humanhash: queen-fish-fillet-spaghetti
File name:Scan_copy00556_pdf.gz
Download: download sample
Signature ModiLoader
Create hunting rule
File size:366'915 bytes
First seen:2020-10-21 08:55:25 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:Nw8+NAgmqWRfa6lorOlH+K/PH1MQMhlQnV9Ml/Ax4YxJeFRIO4q2pMbhYSG/ONRs:NwDNAgbWLiyeSP1qovi/AH8FRIOh26bo
TLSH 2474236DAB47B53511EFF7207F67C161492AA208EAA1F6BE230AD047837540698FCCD9
Reporter abuse_ch
Tags:gz ModiLoader


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: bik0.monoi-logistics.com
Sending IP: 94.140.114.91
From: Uyen Tan <uyentan@santech.com>
Subject: Re: regarding payment
Attachment: Scan_copy00556_pdf.gz (contains "Scan_copy00556.bat")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.18971.14918.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f68c16489fceb172402735c363f05014468f6ac5b747895bbaf4134ceaa2a920/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 06:50:04 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=62gbmse7z2yxeqbhgxbwh4cqcrdi62wfw5dysw526qjuz2vcveqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

gz f68c16489fceb172402735c363f05014468f6ac5b747895bbaf4134ceaa2a920

(this sample)

ModiLoader

Executable exe 37d784463964139b15ff2609fc173c430482c6feebef4a13a37df143e99468e5

  
Dropping
MD5 8dbd1974c93ac8b07e9cf7cc730bda85
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 37d784463964139b15ff2609fc173c430482c6feebef4a13a37df143e99468e5

Comments