MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 341efac93637ec1b71a04d0180570b360dfaf5fc5a6a64ed17ae59208887f38b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 341efac93637ec1b71a04d0180570b360dfaf5fc5a6a64ed17ae59208887f38b
SHA3-384 hash: ab0f8440d36f76cb6a37256b039b72f32db419b8954056e0d66c9f77dccdd4da71913ea1574d44d447b941935266b59f
SHA1 hash: b01445f4c3dc905ece7dc86acf83990283aeac3c
MD5 hash: b80fa65ba45525f8678943ecbe00b046
humanhash: violet-lemon-five-quiet
File name:Платежный документ_91H734.pdf.7z
Download: download sample
Signature ModiLoader
Create hunting rule
File size:580'924 bytes
First seen:2020-10-13 12:28:08 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:ZgrwzwVJJZaKRIVKj6Wap7BO2IPlA1v32M/G8G9GMGiqUVD:ZgrZaKCoj6WapVfItAd32gtsGivd
TLSH 0BC42343F0A969DA1D23BEB0795E235B084626ABFE102C367671657EB9CC2C014971BF
Reporter abuse_ch
Tags:7z ModiLoader


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: bxx0.limp-trades.com
Sending IP: 194.87.139.192
From: Миссис Лим Чанпути <offices@limp-trades.com>
Subject: Re: Платежный документ 91H84926
Attachment: Платежный документ_91H734.pdf.7z (contains "Платежный документ_91H734.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/341efac93637ec1b71a04d0180570b360dfaf5fc5a6a64ed17ae59208887f38b/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 11:05:17 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gqppvsjwg7wbw4najuayavylgyg7v5p4ljvgj3ixvzmsbceh6ofq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/341efac93637ec1b71a04d0180570b360dfaf5fc5a6a64ed17ae59208887f38b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip 341efac93637ec1b71a04d0180570b360dfaf5fc5a6a64ed17ae59208887f38b

(this sample)

ModiLoader

Executable exe 8740660b719c87f2e9deb11c5fbda1a6ffd0c770a571d4945056d53e7a6b31c3

  
Dropping
MD5 f3323a75f5e432c939295d9acea35c60
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8740660b719c87f2e9deb11c5fbda1a6ffd0c770a571d4945056d53e7a6b31c3

Comments