MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f46121c81b1dd6f34c8422792e5df7c771adfd2818db90755dc0cb5af2e74b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f46121c81b1dd6f34c8422792e5df7c771adfd2818db90755dc0cb5af2e74b3
SHA3-384 hash: 03a5df43997e8551c532a118518688a326488bb4b910321a3f6e36ffd95ac3d38195649f25a49dc3ac8f474757ef9e66
SHA1 hash: a6628aee65398ccf589a345d4932e675e6518c31
MD5 hash: 4c273a553420b0d6a4fc98cbf5e53a5e
humanhash: maryland-fourteen-spring-lamp
File name:Listings.zip
Download: download sample
Signature ModiLoader
Create hunting rule
File size:284'131 bytes
First seen:2021-01-12 18:13:15 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Pd77ipv2P7jEefnxoVoOoBN5uoFsd3ZCuHEa4Cx:17ep+U8nxoiIwkkCx
TLSH 9C542353523FB3DD8C709BB8E80005F829B1282C638BB9C19B7815B1E76D9BD950B16F
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server1.climario.com.br
Sending IP: 107.161.183.34
From: Sarah<transportes@climario.com.br>
Reply-To: Leo<boracay@airtaxi.ph>
Subject: ESTATE LISTINGS
Attachment: Listings.zip (contains "Listings.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
150
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.72458.8575.9501.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f46121c81b1dd6f34c8422792e5df7c771adfd2818db90755dc0cb5af2e74b3/
Threat name:
Win32.Spyware.AveMaria
Create hunting rule
Status:
Malicious
First seen:
2021-01-12 18:13:18 UTC
AV detection:
15 of 46 (32.61%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j5dbehebwhow6ngiiitzfzo7pr3rvx6sqgg3sb2v3qglllzooszq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4f46121c81b1dd6f34c8422792e5df7c771adfd2818db90755dc0cb5af2e74b3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip 4f46121c81b1dd6f34c8422792e5df7c771adfd2818db90755dc0cb5af2e74b3

(this sample)

ModiLoader

Executable exe 64ec03c92b5fbbb63420e370ff8f879454ddd61c88f3ff41e2f5ce09eabab5f2

  
Dropping
MD5 8e52804cdbda6301ebcc8305e29a7adb
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 64ec03c92b5fbbb63420e370ff8f879454ddd61c88f3ff41e2f5ce09eabab5f2

Comments