MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1563e9b747cd044141b2352aec93ba7e9d2983b362675f1a449308062c1e0106. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1563e9b747cd044141b2352aec93ba7e9d2983b362675f1a449308062c1e0106
SHA3-384 hash: 31856121893f7e8c4850226d41d103bde7377e0926f4890b88981d763a55ad3744ee14b7382749999ebd2b3167b844f8
SHA1 hash: 2ea5d3285f175d66a1e92666d701c2a831555996
MD5 hash: 833d47ae82a1d68199ab3bb846d0a0ad
humanhash: uniform-grey-shade-vermont
File name:12-4.zip
Download: download sample
Signature ModiLoader
Create hunting rule
File size:522'525 bytes
First seen:2020-12-05 15:24:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:1qTKrUEaHe8KeWye7XZ3qIH6orXK8Fz86Ev5PdV9uHjXsNcoy:1q2MBKeWyeDZtGq86adV9aTsNFy
TLSH 57B42334E7824AE45E48DED1C15528B4105EA7DFA4AC2901C1BBACA303FBAE85DF54F3
Reporter abuse_ch
Tags:ModiLoader zip


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: slot0.goslesey.com
Sending IP: 45.85.90.157
From: ACCOUNT <office@goslesey.com>
Reply-To: ACCOUNT <mail.reply@mail.com>
Subject: BANCO EN RECIBO
Attachment: 12-4.zip (contains "12-4.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
329
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Remcos-9802952-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1563e9b747cd044141b2352aec93ba7e9d2983b362675f1a449308062c1e0106/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-12-05 15:25:06 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cvr6tn2hzucecqnsguvoze52p2osta5tmjtv6gsesmeamla6aeda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/1563e9b747cd044141b2352aec93ba7e9d2983b362675f1a449308062c1e0106

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip 1563e9b747cd044141b2352aec93ba7e9d2983b362675f1a449308062c1e0106

(this sample)

ModiLoader

Executable exe 37cfb7fb31732401d50f7f17c28fbea5997ef4a7236ce89f37dc57675a76b23f

  
Dropping
MD5 86e9f171ca095286ac610deaf54c7667
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 37cfb7fb31732401d50f7f17c28fbea5997ef4a7236ce89f37dc57675a76b23f

Comments