MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd50d66600bb52a965ed2b3cea84da497387b73ae6e005fbd04d6475bb776099. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd50d66600bb52a965ed2b3cea84da497387b73ae6e005fbd04d6475bb776099
SHA3-384 hash: 22edf173feaf9b73e8511be96f85ece66512fe99a146f8ea9ee5fe70ecd208e825b5dd9c54e6092bdd8f391025f6ed5b
SHA1 hash: 77fe2614a2a29d10f93d6e0ae2a4121f604f86db
MD5 hash: 352ec3c1984a88ca7fc084d3a7aeabf1
humanhash: high-illinois-maine-river
File name:07-20-2020_06-59-10-PM.zip
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'270'150 bytes
First seen:2020-08-13 05:46:38 UTC
Last seen:2020-08-13 05:47:51 UTC
File type: zip
MIME type:application/zip
ssdeep 24576:th2o6HCzBMHWYlwB+OyQWl5JMfHMSloaMhdSFFgBW5vjB2Dzem1xsyn++EGhTbL:i1fHWY5QY5J6MUopMDvjmzem1xsX+XfL
TLSH 954533D04C621B88E778C6B18A0154BEAFE64CEED06B96F0DF30C4AD7564355EC4E1AD
Reporter cocaman
Tags:ModiLoader zip


Avatar
cocaman
Malicious email
From: d_georgiewa <d_georgiewa@abv.bg>
Received: from tur2.hipotenus.com (tur2.hipotenus.com [213.159.30.161])
Date: Wed, 12 Aug 2020 15:37:43 +0300
Subject: AW: An-200580
Attachment: 07-20-2020_06-59-10-PM.zip

Intelligence

File Origin
# of uploads :
2
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.PrivateEXEProtector4-6192998-2
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd50d66600bb52a965ed2b3cea84da497387b73ae6e005fbd04d6475bb776099/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 05:48:06 UTC
File Type:
Binary (Archive)
Extracted files:
127
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7vinmzqaxnjkszpnfm6ovbg2jfzypnz243qal66qjvshlo3xmcmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fd50d66600bb52a965ed2b3cea84da497387b73ae6e005fbd04d6475bb776099

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip fd50d66600bb52a965ed2b3cea84da497387b73ae6e005fbd04d6475bb776099

(this sample)

unknown 34b3077c05e5f9e6bff0b6f877df10040bc8c1fd437116378cc78a1bac5cdc4d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 34b3077c05e5f9e6bff0b6f877df10040bc8c1fd437116378cc78a1bac5cdc4d
  
Dropping
SHA256 1bc9f1cdb877b8101e423f4d3809a31b78bdbd7e9dc0cac148c0e67cc8f33089
  
Dropping
SHA256 8c7d1ef39954755927118017241557591fa06f4b29e1ca47c739d394ec4f9657
  
Dropping
SHA256 e01b79e0c73e76e98ddca8c03d801e1742eeb3fec251b17162ef899332a12963
  
Dropping
ModiLoader

Comments