MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8434f255441cd348a87ee9886f4000000f75e98ade5caf0b9e53f8c3f213b45a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8434f255441cd348a87ee9886f4000000f75e98ade5caf0b9e53f8c3f213b45a
SHA3-384 hash: 9087ccca0afb76c509c162ce882e4d2aabcdcc7b60b39a80319891ef0b5df434e8d395833eabe0d0be9db2e12a0e27d1
SHA1 hash: 81d77721b6c9ac628b6d011b46998ff05edb19e6
MD5 hash: 81ab0e356104e7e8abae1e7417427fa0
humanhash: steak-neptune-enemy-wolfram
File name:Νέα παραγγελία.zip
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'195'828 bytes
First seen:2020-08-18 07:38:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:975myArIQg4Y9eyg/op6HrMX1T0hjesKbh2rzJ9xpclpo2m9da:HyIQPKeyg/86gFT0XrzXwllmXa
TLSH C245330A9C6416C5FCEEEE774606092ED8FE9D28EC5ADD2CEE38CBF8443510709B6519
Reporter abuse_ch
Tags:geo GRC ModiLoader zip


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: server.dortgyazilim.com
Sending IP: 37.123.97.174
From: servisteel@metka.gr
Subject: Re: Re: Νέα παραγγελία
Attachment: Νέα παραγγελία.zip (contains "Jnobsbh_Signed_.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25545.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25560.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8434f255441cd348a87ee9886f4000000f75e98ade5caf0b9e53f8c3f213b45a/
Threat name:
Win32.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 07:40:06 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qq2pevkedtjurkd65geg6qaaaahxl2mk3zok6c46kp4mh4qtwrna._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip 8434f255441cd348a87ee9886f4000000f75e98ade5caf0b9e53f8c3f213b45a

(this sample)

ModiLoader

Executable exe 58ced5958ea8fea452bbaa34bba957927c391a0d3699542fb3702cdab990c70a

  
Dropping
MD5 96e8bee2b261a04112e86b8c7c2d4ae4
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 58ced5958ea8fea452bbaa34bba957927c391a0d3699542fb3702cdab990c70a

Comments