MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d923441fe1f5464ec8b13077e2a2f9d4f97d6a32d1c1f1bee777d388d6f8809. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d923441fe1f5464ec8b13077e2a2f9d4f97d6a32d1c1f1bee777d388d6f8809
SHA3-384 hash: bdd73d8faa6790684f5b86734a415778470c4c26478d52d0d7f41665c5793ba843dc6ecd9f78dc0b8d38ad61eab519df
SHA1 hash: 473af9ef7ad4d6d82cf7f837f6ed1e3557c0287c
MD5 hash: 8b98817aed47bf90db7e8c2f2c04d585
humanhash: bulldog-muppet-neptune-salami
File name:Doc Order.zip
Download: download sample
Signature ModiLoader
Create hunting rule
File size:423'723 bytes
First seen:2020-10-20 08:14:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:d5YXtW2ilvx9tTFhX6/QRqtOEm+Ow3KNIiqDFDxNCMp5o7GmPJP2SikFXz:ctWPtTF16oUpth8+FXCMjDmxPZiyXz
TLSH 459423B8F5406476816A077EBCDFE65DAB476DC692CCD4128CFECBC604BA4A815F06C0
Reporter abuse_ch
Tags:ModiLoader zip


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: rdns0.deresa.xyz
Sending IP: 104.131.179.64
From: Emil.stefanek <sales@buhlergroup.com>
Subject: FW: revised document order
Attachment: Doc Order.zip (contains "Doc Order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d923441fe1f5464ec8b13077e2a2f9d4f97d6a32d1c1f1bee777d388d6f8809/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 07:04:46 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fwjdiqp6d5kgj3elcmdx4krptvhzpvvdfuob6g7oo56trdlpraeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/2d923441fe1f5464ec8b13077e2a2f9d4f97d6a32d1c1f1bee777d388d6f8809

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip 2d923441fe1f5464ec8b13077e2a2f9d4f97d6a32d1c1f1bee777d388d6f8809

(this sample)

ModiLoader

Executable exe 6ce29350390228c4f8cf474b079fc0e786b364cf5c0c8994b7ad1137c185be3b

  
Dropping
MD5 51bbe3ed781e4837bb1e78675f490cf9
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6ce29350390228c4f8cf474b079fc0e786b364cf5c0c8994b7ad1137c185be3b

Comments