MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49f1e499decaf0a93be5fa3a74f96611955c753af9179cb9308f2726a4b07d82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49f1e499decaf0a93be5fa3a74f96611955c753af9179cb9308f2726a4b07d82
SHA3-384 hash: 229d93cb09d558bd21daa9ec4df4341c8e8ba6f39c716e397ced62125865328b5f25a4982c524b5a5f7d821c04a2308d
SHA1 hash: 55202569428714780e5ad7fe1b079d8b79838c93
MD5 hash: 1bb385793f1a36879ef5dc952579b00c
humanhash: mexico-two-fourteen-golf
File name:Invoice.rar
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'012'106 bytes
First seen:2020-10-14 15:24:03 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:uIjoI8YtjMe86AN35VpfWS52wWsfxIjoI8YtjMe86AN35VpfWS52wWsfQ:Xjn8Yx86qpzXpWeujn8Yx86qpzXpWeQ
TLSH 872523AB8FF7A852E5D2B01476E171F0B71EDF0E51AC4C212725B02905AC738A1F86F9
Reporter abuse_ch
Tags:ModiLoader rar


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: pop02.hosting-srv.net
Sending IP: 210.152.143.57
From: Account <bstmpia@shapla.net>
Subject: Pending Invoice.
Attachment: Invoice.rar (contains "Invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27502.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/49f1e499decaf0a93be5fa3a74f96611955c753af9179cb9308f2726a4b07d82/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 20:04:12 UTC
AV detection:
17 of 47 (36.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jhy6jgo6zlykso7f7i5hj6lgcgkvy5j27elzzojqr4tsnjfqpwba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/49f1e499decaf0a93be5fa3a74f96611955c753af9179cb9308f2726a4b07d82

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

rar 49f1e499decaf0a93be5fa3a74f96611955c753af9179cb9308f2726a4b07d82

(this sample)

ModiLoader

Executable exe 85c2475f5bb564338727b25d030019e2ec0f08a9892df26024e45339ef3c0792

  
Dropping
MD5 483c887a593d47d8c5df60f9497ef9bb
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 85c2475f5bb564338727b25d030019e2ec0f08a9892df26024e45339ef3c0792

Comments