MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f3eb0d28265e979bec736a7bf78671f673bdab8a07b0df2810cd42d57c49385. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f3eb0d28265e979bec736a7bf78671f673bdab8a07b0df2810cd42d57c49385
SHA3-384 hash: 2bb9de119988a2ecaaa9fbf1b1dad0852f1f42edbca5e7b93ec47f2eb2f50264955421f89d2de4f73b1358c91d5f804b
SHA1 hash: 8e88c83526eb0d163fbea4314cca5918ad1a0650
MD5 hash: b5750d75876bbd4f71a183f868341d7f
humanhash: one-grey-bravo-washington
File name:Limp-Trades_Payment_Remittance_26_August_2020_Signed.pdf.z
Download: download sample
Signature ModiLoader
Create hunting rule
File size:671'357 bytes
First seen:2020-08-30 06:34:58 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:6PtqBLxQeDZCZ9nwa+fAHhFgHezFsDqMn1yAY+9O2Tpeo5o4fHa7BwrX8JhK:xBLx1DZYiAHsezYqM1ygE2Tpeor6DhK
TLSH 11E43397AC18DBC75223DD720217AA39E3BCD6F1578A7386DEE4B022135CB2D0453A9D
Reporter abuse_ch
Tags:ModiLoader z


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: min0.limp-trades.com
Sending IP: 185.82.126.208
From: Account Payable <accountpayable@limp-trades.com>
Reply-To: <mobilecommunications@vivaldi.net>
Subject: Fw : Re: Payment Remittance
Attachment: Limp-Trades_Payment_Remittance_26_August_2020_Signed.pdf.z (contains "Limp-Trades_Payment_Remittance_26_August_2020_Signed_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

PUA.Win.Adware.Qjwmonkey-6892535-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8f3eb0d28265e979bec736a7bf78671f673bdab8a07b0df2810cd42d57c49385/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-30 06:36:08 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r47lbuucmxuxtpwhg2t366dhd5ttxwvyub5q34ubbtkc2v6esocq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/8f3eb0d28265e979bec736a7bf78671f673bdab8a07b0df2810cd42d57c49385

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip 8f3eb0d28265e979bec736a7bf78671f673bdab8a07b0df2810cd42d57c49385

(this sample)

ModiLoader

Executable exe b553eccde98f7d193d5518a765c8a22eb65dd5f29026c96045892c47525536de

  
Dropping
MD5 1780e97a45f7f5fb9663b8275bdbb57b
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b553eccde98f7d193d5518a765c8a22eb65dd5f29026c96045892c47525536de

Comments