MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a2986fd4b7e7c93b87fa568c13e084c1ecc5f5fc766ef9a65e861b97074c60f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a2986fd4b7e7c93b87fa568c13e084c1ecc5f5fc766ef9a65e861b97074c60f
SHA3-384 hash: 71c170798a0e9ec0f861e1eafa85a16829e598ab872993cd4694b1f972f055354e7cb96534382b3be97aa86fb889e71e
SHA1 hash: a4d7436c4361e02355615cb23a9453f7d99ae9ad
MD5 hash: 627f9260384ff144bfe00ed17c201ea8
humanhash: batman-pluto-apart-neptune
File name:new purchase order No 0696846238 9684753285.zip
Download: download sample
Signature ModiLoader
Create hunting rule
File size:487'941 bytes
First seen:2020-08-04 13:30:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:c+Tqw0kc9wEAILTdZtkr/m6FDHbR2GQP9uetRKt9AiGD7f:c6qw8Slr+UHbUGkMfGiIj
TLSH 8EA4232B6444D27074B8D119A22D5EA66F03AA66FE471F821F6F733ABE5C4CE00D7750
Reporter abuse_ch
Tags:ModiLoader zip


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: static.33.46.181.135.clients.your-server.de
Sending IP: 135.181.46.33
From: grace@lin3rs.com
Subject: NEW ORDER
Attachment: new purchase order No 0696846238 9684753285.zip (contains "new purchase order No 0696846238 9684753285.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Browsefox-6628766-0
Create hunting rule

PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9a2986fd4b7e7c93b87fa568c13e084c1ecc5f5fc766ef9a65e861b97074c60f/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 13:32:07 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tiuyn7klpz6jhod7uvumcpqijqpmyx27y5to7gtf5bq3s4duyyhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9a2986fd4b7e7c93b87fa568c13e084c1ecc5f5fc766ef9a65e861b97074c60f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip 9a2986fd4b7e7c93b87fa568c13e084c1ecc5f5fc766ef9a65e861b97074c60f

(this sample)

ModiLoader

Executable exe 9d9739b817d35a815e89c74d8e04d1571e5591de09ca6e8d7a634b140db45605

  
Dropping
MD5 2149d478dc2ab312f830411d32e49332
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9d9739b817d35a815e89c74d8e04d1571e5591de09ca6e8d7a634b140db45605

Comments