MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4e61f0aec05adc008e39902fb864108bfcb5210fb500205db99135120810a587. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 4
| SHA256 hash: | 4e61f0aec05adc008e39902fb864108bfcb5210fb500205db99135120810a587 |
|---|---|
| SHA3-384 hash: | 18b501070945876018b1d9b395d7633f4246307133142a48139ba92f5879f4fed4e7f9ccb86b82cc39d5151dd6f10a0d |
| SHA1 hash: | 3a2f2c68c3a93a0e17fbe600d29bbaa4ddfbe102 |
| MD5 hash: | f202e977bc2b6cad884624fbbd641d75 |
| humanhash: | earth-freddie-pip-double |
| File name: | Purchase order L-BE2002297,pdf.exe |
| Download: | download sample |
| File size: | 880'640 bytes |
| First seen: | 2020-06-09 13:48:34 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 2879dffa5316604be785ffdc4daa690c (1 x NetWire) |
| ssdeep | 12288:jIGMhxKRAid8RJeSDnHnAplvUrsHHS40jatI2gG3cRUngXnNPtB:jUhpiGRJ5DneMIyGtIW3nKnNF |
| Threatray | 236 similar samples on MalwareBazaar |
| TLSH | 8E156C26F7914C73C133293DAC5BD674D83ABE612A24A8C52BE83D784B79385352D1B3 |
| Reporter |  abuse_ch |
| Tags: | exe |
abuse_ch
Malspam distributing unidentified malware:HELO: cloudhost-401319.us-midwest-1.nxcli.net
Sending IP: 209.87.159.195
From: Ottenschläger GmbH <info@ottenschlaeger.de>
Subject: RE:PURCHASE ORDER
Attachment: Purchase order L-BE2002297,pdf.iso (contains "Purchase order L-BE2002297,pdf.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Infostealer.Fareit
Status:
Malicious
First seen:
2020-06-09 13:50:08 UTC
File Type:
PE (Exe)
Extracted files:
47
AV detection:
24 of 29 (82.76%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
suspicious
Similar samples:
+ 226 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Score:
10/10
Tags:
family:modiloader
Behaviour
Script User-Agent
Legitimate hosting services abused for malware hosting/C2
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe 4e61f0aec05adc008e39902fb864108bfcb5210fb500205db99135120810a587
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.