MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1dac63c5a705ddcad35df9429ebb7b8cd52de679886c6e52db75ad5f96fd2746. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1dac63c5a705ddcad35df9429ebb7b8cd52de679886c6e52db75ad5f96fd2746
SHA3-384 hash: 23892b46ba40d245917b08b1e51299ee7cfe30b3165ef990cf0edfd9d9392150d549f8aefde772c432c70211ba1b0f35
SHA1 hash: d4e5eef20aadc3cd77b743b63b3cde1c9a9f5345
MD5 hash: 0cb74c3317d2899a877fe5a54d0280bd
humanhash: ohio-uniform-salami-green
File name:5070221000EXTRA8sets_10-14-2020,pdf.zip
Download: download sample
Signature ModiLoader
Create hunting rule
File size:561'179 bytes
First seen:2020-10-14 15:21:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:/EhPV0+loEfMN3O9OxbgPgLE+wg7ohmVzv7qZ5U6:/0VUD5O8UoLEfg9DIB
TLSH 02C4231D5C338CB6D9843665A2BFD84C491A0678B6B431F25579CC8E8B9A8037F8FBC1
Reporter abuse_ch
Tags:ModiLoader zip


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: plesk1.enpatagonia.net
Sending IP: 209.126.124.211
From: NSD VINA CO., LTD <info2@nsdvina.com>
Subject: URGENT !!! INV-5070221000+SG_8more PS(#2447)
Attachment: 5070221000EXTRA8sets_10-14-2020,pdf.zip (contains "5070221000(EXTRA8sets)_10-14-2020,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FZO3F05723148BD.27928.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1dac63c5a705ddcad35df9429ebb7b8cd52de679886c6e52db75ad5f96fd2746/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 14:01:01 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dwwghrnhaxo4vu257fbj5o33rtks3ztzrbwg4uw3owwv7fx5e5da._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/1dac63c5a705ddcad35df9429ebb7b8cd52de679886c6e52db75ad5f96fd2746

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip 1dac63c5a705ddcad35df9429ebb7b8cd52de679886c6e52db75ad5f96fd2746

(this sample)

ModiLoader

Executable exe 8e0f1afb542d73ead6c9942171d40ba9117a2b6f39c386ba9e51b22b78c7005f

  
Dropping
MD5 3f05723148bd359d5aeea5b1aac507f5
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8e0f1afb542d73ead6c9942171d40ba9117a2b6f39c386ba9e51b22b78c7005f

Comments