MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 292c8c1967b96a0386aa13e3f4663f75025a67aad2e6f13aa6b7e8aa95e195bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 292c8c1967b96a0386aa13e3f4663f75025a67aad2e6f13aa6b7e8aa95e195bc
SHA3-384 hash: d974026b082cfd87c7d8d9371b124553d9cb82824c8a0b25932123f96ff3a820882367afa3884967469f6eb5823eb65e
SHA1 hash: 0f9832c6d01d232be5e344cfdc77832f2555005c
MD5 hash: c2a4d2f11bfcebb60083d015b74e6ce8
humanhash: coffee-alpha-jig-autumn
File name:Payment_details.rar
Download: download sample
Signature ModiLoader
Create hunting rule
File size:254'284 bytes
First seen:2020-12-23 19:20:27 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:HcokoeZcybHjxYY8hahBVkGrp5eOndgNeU:iGqYYLrp5eOn6/
TLSH 2144238C903E66DC1ECD0EFA598CDB3D1F1252C8B5673CE584960DDA2E234A1562F86F
Reporter abuse_ch
Tags:ModiLoader rar


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: mail0.fycompanies.com
Sending IP: 174.138.17.231
From: Manikandan Elumalai <info5@fycompanies.com>
Subject: Payment
Attachment: Payment_details.rar (contains "Payment_details.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
966
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/292c8c1967b96a0386aa13e3f4663f75025a67aad2e6f13aa6b7e8aa95e195bc/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-12-23 19:21:05 UTC
AV detection:
20 of 46 (43.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fewiyglhxfvahbvkcpr7izr7oubfuz5k2ltpcovgw7ukvfpbsw6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/292c8c1967b96a0386aa13e3f4663f75025a67aad2e6f13aa6b7e8aa95e195bc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

rar 292c8c1967b96a0386aa13e3f4663f75025a67aad2e6f13aa6b7e8aa95e195bc

(this sample)

ModiLoader

Executable exe 8a6768e4157433dabc90663bb00e5f0ac8294d30409de6bcf57faed3fd1bf2f0

  
Dropping
MD5 873a35fe0ed3ac6bb326c71a2d951865
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8a6768e4157433dabc90663bb00e5f0ac8294d30409de6bcf57faed3fd1bf2f0

Comments