MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 475888c98cc9fe79613544ff3fda700982c9114486e6871364244273a754b733. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 475888c98cc9fe79613544ff3fda700982c9114486e6871364244273a754b733
SHA3-384 hash: ac3d01f446a1e34671fa53e3b6df647837aac917d5cf5352c0bf5a989736aaf201cb0b7285989c913eaa693c075b4b72
SHA1 hash: b915d031e6ec9fd3612ec9221502fae8b064f6c8
MD5 hash: 939552269130cc9da1e5a9ca48c95163
humanhash: nineteen-kitten-vegan-apart
File name:eInvoicing_pdf.xz
Download: download sample
Signature ModiLoader
Create hunting rule
File size:262'448 bytes
First seen:2020-10-06 06:47:32 UTC
Last seen:2020-10-06 06:55:32 UTC
File type: xz
MIME type:application/x-rar
ssdeep 6144:1x0OUHCx+PJQtcdNnX0uVbAWLU3qKIm/cYsPjX3GJoI/Cwni:L0TigPGtcdNnXVZ0Im/cLX2JAwi
TLSH 7A4423333FC6725F9AA5BD7B432288492D0198C171BCE765AD58D8B5B32932F2227C53
Reporter _Clevero
Tags:ModiLoader rar TNT


Avatar
_Clevero
Sending IP: 159.89.9.44
Sender FROM: "eInvoicing" <tntsupport.admin@tnt.com>
Sender SMTP: tntsupport.admin@tnt.com
Subject: TNT Express Invoice: 2297456 - Account: 000011333

Intelligence

File Origin
# of uploads :
3
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/475888c98cc9fe79613544ff3fda700982c9114486e6871364244273a754b733/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 06:49:06 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i5mirsmmzh7hsyjvit7t7wtqbgbmsekeq3tioe3eerbhhj2uw4zq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/475888c98cc9fe79613544ff3fda700982c9114486e6871364244273a754b733

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

xz 475888c98cc9fe79613544ff3fda700982c9114486e6871364244273a754b733

(this sample)

ModiLoader

Executable exe 1f04efba216a70f67f7d86cb3cfdccb282adcf9bfa3b5fb01168befcf584639c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1f04efba216a70f67f7d86cb3cfdccb282adcf9bfa3b5fb01168befcf584639c
  
Dropping
MD5 14656f7a0cee96bc0dd879110154a770

Comments