MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0813c0ebc7092012c4dbfe613cdd7b3f52dc175a2ced5a9893ac0b17484881f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0813c0ebc7092012c4dbfe613cdd7b3f52dc175a2ced5a9893ac0b17484881f8
SHA3-384 hash: 5ee02886c06ec52bed92b6092795f6b2b6449a4a6617decf11936f951c88c999d6c9e6696520e311e6f2d38f1842a70c
SHA1 hash: 7465ac2c36f89b91676376bdfbb53048e3fb80d2
MD5 hash: 7fef9b35dc75bc140aff28c7c1cf0454
humanhash: social-charlie-saturn-harry
File name:INV0595.rar
Download: download sample
Signature ModiLoader
Create hunting rule
File size:251'136 bytes
First seen:2020-08-14 10:57:54 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Y4GmtwY0FuE+EB+rjdqsvfHSmxc217AJv+shMY+MEE0:YjmtwPkmB+r5BvNc2eN+shMY+3E0
TLSH 0334232F013D6B46492324B30F7DD48FF17AB4B82C441B66BAA66752844EB87B06C677
Reporter abuse_ch
Tags:ModiLoader rar


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: poydorus.t.mk
Sending IP: 195.26.152.36
From: f.petrovski@bulmak2016.com.mk <f.petrovski@bulmak2016.com.mk>
Subject: Re: factura revisada
Attachment: INV0595.rar (contains "INV#0595.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0813c0ebc7092012c4dbfe613cdd7b3f52dc175a2ced5a9893ac0b17484881f8/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=baj4b26hbeqbfrg37zqtzxl3h5jnyf22ftwvvgetvqfrosciqh4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0813c0ebc7092012c4dbfe613cdd7b3f52dc175a2ced5a9893ac0b17484881f8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

rar 0813c0ebc7092012c4dbfe613cdd7b3f52dc175a2ced5a9893ac0b17484881f8

(this sample)

ModiLoader

Executable exe bfea5a7839b0a45d3e0074b6e3882ada8f6aa913cf7e0d08ba290a49af855596

  
Dropping
MD5 e0a4e6378c211f8584be6aea083c9743
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bfea5a7839b0a45d3e0074b6e3882ada8f6aa913cf7e0d08ba290a49af855596

Comments