#Modiloader X Hashtag

Explore tweets tagged as #Modiloader

Karol Paciorek

@karol_paciorek

1 year

🚨 Suspicious IP #opendir:.209.126.87[.92:8888. 🌐 Domain:.premiere-coal-tonight-procedure.trycloudflare[.com . 🔗 File chain:.iz.exe - #modiloader #remcos.🔽.onedrive[.live.com/download?resid=F4D24344D7B13420%21110&authkey=!AL5-vxbOzO8Bd8E.🔽.255_Sraomttecbk. 📝 1/2

4

13

33

Kyle Cucci

@d4rksystem

1 year

Dropping a #Yara rule for a new variant of #DBatLoader/#ModiLoader in the wild:. #100DaysOfYara

0

6

24

m4n0w4r

@kienbigmummy

2 years

#DBatLoader #ModiLoader 🔥

0

4

26

ܛܔܔܔܛܔܛܔܛ

@skocherhan

1 month

taqareer[.]tech.#modiloader #Remcos

1

3

Karol Paciorek

@karol_paciorek

1 year

🔓#opendir 147.50.253[.30. 🔑Abotihy.exe - #PHEMEDRONE. 🔗C2:.💬/bot5358754228:AAE42HAGW1bzIPxU7iVRC_96iDuHcwSjjVo/sendMessage?chat_id=5556872222. 🖥️8888.exe - #MODILOADER -> 147.50.253[.30:8888 -> Process.exe. 🖥️Client.exe - #NJRAT -> 147.50.253[.30:6522 -> WindowsServices.exe

2

9

41

SANS.edu Internet Storm Center

@sans_isc

2 years

ISC Diary: @malware_traffic saw #GuLoader or #ModiLoader/#DBatLoader style traffic for #RemcosRAT

1

22

37

m4n0w4r

@kienbigmummy

5 years

Recently, I have been investigating a malware loader which is ModiLoader. This loader is delivered through the Malspam services to lure end users to execute malicious code. #VinCSS #ModiLoader #MalwareAnalysis #Z2A

1

21

69

m4n0w4r

@kienbigmummy

3 years

🔥#maldoc sample spread #ModiLoader(#DBatLoader) was submitted from VN. 🐛hash:797ad98c5e34adaf78da488638b1bfe724d2750844e2d67725b0e84a2aa14c06.☠️external link->#mal rtf->contain #sc->download #ModiLoader payload (1/2)

3

18

50

Ankit Anubhav

@ankit_anubhav

4 years

#formbook #guloader #modiloader #dbatloader #cloudeye

1

3

5

Virus Bulletin

@virusbtn

2 months

AhnLab's ASEC team identify and analyse cases of the ModiLoader (DBatLoader) malware being distributed via emails impersonating a Turkish bank and leading to SnakeKeylogger.

1

13

27

SANS.edu Internet Storm Center

@sans_isc

2 years

ISC Diary: @malware_traffic reviews #Formbook from possible #ModiLoader (#DBatLoader)

0

21

62

ܛܔܔܔܛܔܛܔܛ

@skocherhan

2 months

32ba1ee78874a80a23a0d09427d52af6.05ef4ca659965c1d3faa58077b0f9943.#FormBook #ModiLoader #DBatLoader

Simplicio Sam L.

@marsomx_

2 months

[4/4].drop url:.176.65.144[.23/ff/kkinng.txt.sha256: .954b611a8e8163b42691ec83d4ff0077ef6f80505a434d03e04c9ae19494ea13.

0

1

Ne0ne | Igal

@0xToxin

3 years

"Pre_Procurement Verification (Mog Energy)_Ref_TR0029388827772_10_27_2022". malspam mail -> sharepoint URL -> password protected 7z -> 3 #modiloader -> #AveMaria executables. C2: pentester0.accesscam[.org. Bazaar:. check comments for #modiloader opendir

1

8

13

Security Onion

@securityonion

2 years

Today's quick #malware analysis with #SecurityOnion:. FORMBOOK from possible MODILOADER pcap from 2023-06-16. Thanks to @malware_traffic for sharing this #pcap!. More screenshots:. #infosec.#infosecurity.#CyberSecurity.#ThreatHunting.#IncidentResponse

1

10

19

Ankit Anubhav

@ankit_anubhav

3 years

#Modiloader / #Dbatloader . The .z archive leads to exe, which uses lVali UserAgent to download encrypted file from Onedrive ( so MS doesn't take it down ). Post decryption its injected in legit MS process like sndvol to do the C2 comms on 42020 port.

1

19

37

Chris

@phage_nz

3 years

ModiLoader/Netwire RAT with UAC bypass script. OneDrive host: tgkzva.db.files.1drv[.]com C2 hosts: 213.152.162[.]181 184.75.221[.]171 199.249.230[.]27 185.103.96[.]143 185.104.184[.]43 C2 Port: 5133 Sample: