MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aeab185c4d463b30865fd49e0f69589d732f7e70cfd2ebdc29aa69f9cac3051e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aeab185c4d463b30865fd49e0f69589d732f7e70cfd2ebdc29aa69f9cac3051e
SHA3-384 hash: 1e3e957cc90326be4f31ab85233351ae7f85852fec9f095993a034b34dfae6a233627f8fcdebde57e81bc959478a65f0
SHA1 hash: 31b78956098735c678e9e09cde587c0b1d1f45fc
MD5 hash: eb5e2ac35b56613cad7fb1c80bab814d
humanhash: failed-december-leopard-alabama
File name:RFQ_282008.xz
Download: download sample
Signature ModiLoader
Create hunting rule
File size:671'422 bytes
First seen:2020-08-28 06:36:29 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:yynoRgtNrYyNEAo9eBHadZZPomCvqMaC7CuPN7uHn78ofGqaTBwrX8Qn9:yioRQNrYyeAlVEZRCvqML7l7ufGdW
TLSH 9BE423D939BFD00243BE7E63014E8800B05B87710D12FD592B47E61EE62A5859D6EFDE
Reporter abuse_ch
Tags:ModiLoader xz


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: tcfs.net.in
Sending IP: 92.223.93.162
From: Lizzy Zu <sales@tcfs.net.in>
Reply-To: ital_rnachine2013@yahoo.com
Subject: RFQ
Attachment: RFQ_282008.xz (contains "RFQ_282008.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

PUA.Win.Adware.Qjwmonkey-6892535-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aeab185c4d463b30865fd49e0f69589d732f7e70cfd2ebdc29aa69f9cac3051e/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-28 06:38:03 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v2vrqxcniy5tbbs72spa62kytvzs67tqz7joxxbjvju7tswdaupa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aeab185c4d463b30865fd49e0f69589d732f7e70cfd2ebdc29aa69f9cac3051e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip aeab185c4d463b30865fd49e0f69589d732f7e70cfd2ebdc29aa69f9cac3051e

(this sample)

ModiLoader

Executable exe 9d71c01a2e63e041ca58886eba792d3fc0c0064198d225f2f0e2e70c6222365c

  
Dropping
MD5 36a2061a6df7f0f3c608a8a140af14b3
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9d71c01a2e63e041ca58886eba792d3fc0c0064198d225f2f0e2e70c6222365c

Comments