MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 434e45731bdeeb2f801a42ec2b506cba3457e5afc4280101541fbbfeab791b1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 434e45731bdeeb2f801a42ec2b506cba3457e5afc4280101541fbbfeab791b1e
SHA3-384 hash: 2b01b353e41706ca4121c1a21b222c3534192c322a465056bcf3a455afb9a741b9f6472b39357035f80de16cd854da68
SHA1 hash: b615844f99c377a34850bc401b10e2a68872c7dd
MD5 hash: b60b30f8dd0321b6b88cda4024dad5bd
humanhash: edward-network-sierra-tango
File name:Purchase Order Confirmation.rar
Download: download sample
Signature ModiLoader
Create hunting rule
File size:276'977 bytes
First seen:2020-10-16 17:44:33 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:R+wIkc7L6AHFTAHQpTNYqB3p9XeGVioavapu56:AwIf/6A1AwpTyg3p9XeQJpuw
TLSH C144232BF5B71A98B91E0C0E605923B9D7011E9547831D3B9410728F79F3CCBB6DADA2
Reporter abuse_ch
Tags:ModiLoader rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: srv12.octenium.net
Sending IP: 54.39.167.221
From: office@gmimpex.ro
Reply-To: office@gmimpex.ro
Subject: Re: Order Confirmation
Attachment: Purchase Order Confirmation.rar (contains "Purchase Order Confirmation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/434e45731bdeeb2f801a42ec2b506cba3457e5afc4280101541fbbfeab791b1e/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-16 16:36:33 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=inhek4y333vs7aa2ilwcwudmxi2fpznpyquacakud6575k3zdmpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/434e45731bdeeb2f801a42ec2b506cba3457e5afc4280101541fbbfeab791b1e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

rar 434e45731bdeeb2f801a42ec2b506cba3457e5afc4280101541fbbfeab791b1e

(this sample)

ModiLoader

Executable exe 46ff7f6619eda7e3b2c5b36a2d3f21b154749d31ae2695c4d23c992361ce1f58

  
Dropping
MD5 ba6c4f2bf9f430a528e3261c3fa915bc
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 46ff7f6619eda7e3b2c5b36a2d3f21b154749d31ae2695c4d23c992361ce1f58

Comments