#ModiLoader - Twitter Hashtag

Cert AgID @AgidCert

12 months ago

🇮🇹 Campagna #Remcos tramite #Modiloader 🎯 Italia ⚔️ TTP: ZIP > JS > PIF 🦠 #IoC👇 🔗 https://t.co/gJeE9PWOHP (Telegram)

0

12

4

2

633

ܛܔܔܔܛܔܛܔܛ

@skocherhan

about 1 year ago

taqareer[.]tech #modiloader #Remcos

1

3

1

0

879

ܛܔܔܔܛܔܛܔܛ

@skocherhan

about 1 year ago

lightstone[.]ae #modiloader @userlolxxl @AbuseAE

2

6

2

1

373

ܛܔܔܔܛܔܛܔܛ

@skocherhan

about 1 year ago

32ba1ee78874a80a23a0d09427d52af6 05ef4ca659965c1d3faa58077b0f9943 #FormBook #ModiLoader #DBatLoader

Simplicio Sam L. @marsomx_

about 1 year ago

[4/4] drop url: 176.65.144[.23/ff/kkinng.txt sha256: 954b611a8e8163b42691ec83d4ff0077ef6f80505a434d03e04c9ae19494ea13 https://t.co/TvHvU6vGnW

0

2

0

338

0

1

0

211

Cybersecurity News Everyday

@TweetThreatNews

over 1 year ago

🚨 AhnLab warns of ModiLoader (DBatLoader) malware exploiting CAB file headers to bypass email security. Delivered via purchase orders, this threat executes malicious commands. Stay vigilant! 🛡️ #ModiLoader #MalwareAlert #India #ThreatResearch link: https://t.co/wgP0MBnNsh

TweetThreatNews's tweet photo. 🚨 AhnLab warns of ModiLoader (DBatLoader) malware exploiting CAB file headers to bypass email security. Delivered via purchase orders, this threat executes malicious commands. Stay vigilant! 🛡️ #ModiLoader #MalwareAlert #India #ThreatResearch

link: https://t.co/wgP0MBnNsh https://t.co/3qTRIqIWh9

0

1

0

56

FatzQatz @FatzQatz

over 1 year ago

Threat actor turns a Cabinet (CAB) file into the Loader. It dropped #ModiLoader (aka #DBatLoader) and ultimately deployed Agent Tesla. NEOMS_EOI_FORM.cmd (yep this is CAB file) SHA256: a631e4304cf932de1129cc660fd648125226cfee4059321b4e2048c38b2f9357 Rules & IOCs in🧵 #malware

FatzQatz's tweet photo. Threat actor turns a Cabinet (CAB) file into the Loader. It dropped #ModiLoader (aka #DBatLoader) and ultimately deployed Agent Tesla.

NEOMS_EOI_FORM.cmd (yep this is CAB file)
SHA256: a631e4304cf932de1129cc660fd648125226cfee4059321b4e2048c38b2f9357

Rules & IOCs in🧵

#malware https://t.co/lI7OkAZmsP

1

3

1

391

Shanholo @ShanHolo

over 1 year ago

🚨#Opendir #Malware 🚨 ⚠️#ModiLoader ☣️audiodg.exe➡️bbf710c83246092a538128620853d4fd 📡C2:hxxps://maan2u.com/doc/233_Qzzgbhhaaml ℹ️ C:\\Users\\Public\\pha.pif -WindowStyle hidden -Command Add-MpPreference -ExclusionExtension '.exe','bat','.pif'

$ShanHolo's tweet photo. 🚨#Opendir #Malware 🚨 ⚠️#ModiLoader ☣️audiodg.exe➡️bbf710c83246092a538128620853d4fd 📡C2:hxxps://maan2u.com/doc/233_Qzzgbhhaaml ℹ️ C:\\Users\\Public\\pha.pif -WindowStyle hidden -Command Add-MpPreference -ExclusionExtension '.exe','bat','.pif' https://t.co/p5Qm30nY5c$

1

5

2

0

703

Andrea (Drego) Draghetti 👨🏻‍💻 🎣 @AndreaDraghetti

almost 2 years ago

Campagne #Malware #Italy Week 35 🔥☠️💣👻 #VIPKeylogger: Bonifico #Remcos: Spedizioni #Formbook: Ordini #AgentTesla: Pagamento #Modiloader: Preventivi #APK #Zanubis: Protezione Device #mwitaly

AndreaDraghetti's tweet photo. Campagne #Malware #Italy Week 35

🔥☠️💣👻

#VIPKeylogger: Bonifico
#Remcos: Spedizioni
#Formbook: Ordini
#AgentTesla: Pagamento
#Modiloader: Preventivi
#APK #Zanubis: Protezione Device

#mwitaly https://t.co/lnT4UMP79W

0

2

0

363

ESET Research

@ESETresearch

almost 2 years ago

The overall number of Rescoms samples delivered via AceCryptor nonetheless declined by 75%. It seems that the delivery method of Rescoms in the region has switched to #ModiLoader. We registered several notable ModiLoader phishing campaigns in May, see https://t.co/VsBQEpMndC. 4/6

1

3

1

0

2K

Threat Intelligence @threatintel

almost 2 years ago

#ThreatProtection #ModiLoader #malware campaign targeting Small and Medium-Sized Business (#SMB) in #Poland, read more about Symantec's protection: https://t.co/VeJpO7OBQQ

0

2

0

2K

ESET DACH @ESET_de

almost 2 years ago

„Die Nachricht sah so legitim aus, wie sie nur hätte sein können.“ Der E-Mail-Anhang war allerdings bösartig und lud #Malware nach. #ESET Forscher haben neue, breit angelegte #Phishing-Kampagnen mit #ModiLoader entdeckt. 🔎https://t.co/HYeOyT72HB #WeLiveSecurity

ESET_de's tweet photo. „Die Nachricht sah so legitim aus, wie sie nur hätte sein können.“
Der E-Mail-Anhang war allerdings bösartig und lud #Malware nach.
#ESET Forscher haben neue, breit angelegte #Phishing-Kampagnen mit #ModiLoader entdeckt.
🔎https://t.co/HYeOyT72HB
#WeLiveSecurity

0

1

0

46

ESET Research

@ESETresearch

almost 2 years ago

#ESETresearch detected multiple phishing campaigns targeting SMBs in 🇵 Poland, distributing #Rescoms (aka #Remcos), #AgentTesla, and #Formbook malware via #ModiLoader. https://t.co/VsBQEpMndC 1/7

1

37

16

9

5K

WatchingRac @RacWatchin8872

about 2 years ago

#opendir #trojan #modiloader hxxp://103.230.121.]50 - 1.exe - Trojan - Build.exe - Moldiloader - Crypted.Exe - Trojan - main.exe - Trojan - server.exe - Trojan

RacWatchin8872's tweet photo. #opendir #trojan #modiloader
hxxp://103.230.121.]50
- 1.exe - Trojan
- Build.exe - Moldiloader
- Crypted.Exe - Trojan
- main.exe - Trojan
- server.exe - Trojan https://t.co/3KnEPsg5xo

1

4

0

1

182

Karol Paciorek @karol_paciorek

about 2 years ago

🚨 Suspicious IP #opendir: 209.126.87[.92:8888 🌐 Domain: premiere-coal-tonight-procedure.trycloudflare[.com 🔗 File chain: iz.exe - #modiloader #remcos 🔽 onedrive[.live.com/download?resid=F4D24344D7B13420%21110&authkey=!AL5-vxbOzO8Bd8E 🔽 255_Sraomttecbk 📝 1/2

karol_paciorek's tweet photo. 🚨 Suspicious IP #opendir:
209.126.87[.92:8888

🌐 Domain:
premiere-coal-tonight-procedure.trycloudflare[.com

🔗 File chain:
iz.exe - #modiloader #remcos
🔽
onedrive[.live.com/download?resid=F4D24344D7B13420%21110&authkey=!AL5-vxbOzO8Bd8E
🔽
255_Sraomttecbk

📝 1/2 https://t.co/ujZDHhZJ6i

4

33

12

9

4K

Kyle Cucci @d4rksystem

about 2 years ago

Dropping a #Yara rule for a new variant of #DBatLoader/#ModiLoader in the wild: https://t.co/oQdEgTCHk9 #100DaysOfYara

0

24

5

2

2K

Karol Paciorek @karol_paciorek

over 2 years ago

🔓#opendir 147.50.253[.30 🔑Abotihy.exe - #PHEMEDRONE 🔗C2: 💬/bot5358754228:AAE42HAGW1bzIPxU7iVRC_96iDuHcwSjjVo/sendMessage?chat_id=5556872222 🖥️8888.exe - #MODILOADER -> 147.50.253[.30:8888 -> Process.exe 🖥️Client.exe - #NJRAT -> 147.50.253[.30:6522 -> WindowsServices.exe