MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ebf706e0221e864d4f5cdda6231228add44f3a4d07e70c7a521e7a8141ef02a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ebf706e0221e864d4f5cdda6231228add44f3a4d07e70c7a521e7a8141ef02a
SHA3-384 hash: 33d14f1200ea512eeb2f401583eab655b19a00ddaca1f7333f2bbc709d0d9683d85cb26c60f1c20a8e7031ea3311b8e7
SHA1 hash: 5812fcd39223a679ec68cbbb9a9d4b8333743a77
MD5 hash: 803bcc584b5c6bb6f2b6344a916e6d85
humanhash: equal-sodium-sweet-bulldog
File name:file.zip
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'119'638 bytes
First seen:2020-07-29 11:37:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:POCjQOghvNsJSHbBVYvS3rh7B7+UGRBixKzmepd5eo:mO9E3iS7ZB7+UaiSF1eo
TLSH A235331A6C4CA54F4D4ADD725CC600A63FEB9472ED9BCE23E1B80668F0B1DCD4579A23
Reporter abuse_ch
Tags:geo ModiLoader SRB zip


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: lhost7.websahibi.com
Sending IP: 213.142.143.189
From: office@crlink.rs
Subject: Re: Re: молимо да проверите нашу нову поруџбину
Attachment: file.zip (contains "Lpnvqmt_Signed_.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25545.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25560.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ebf706e0221e864d4f5cdda6231228add44f3a4d07e70c7a521e7a8141ef02a/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 11:39:05 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j27xa3qcehugjvhvzxngemjcrlouj45e2b7hbr5feht2qfa66ava._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4ebf706e0221e864d4f5cdda6231228add44f3a4d07e70c7a521e7a8141ef02a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip 4ebf706e0221e864d4f5cdda6231228add44f3a4d07e70c7a521e7a8141ef02a

(this sample)

ModiLoader

Executable exe 6afac1117b8398317f5eb5f8c66ce52c0fcf2e438a0d40743a584eedd17ac260

  
Dropping
MD5 97daa53cc8913cb00f49b1a45fb8bc2e
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6afac1117b8398317f5eb5f8c66ce52c0fcf2e438a0d40743a584eedd17ac260

Comments