MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50deb8f0b6ee68d6dffbe91eafdda436a45b6aba104e723f18a0b778704591c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 50deb8f0b6ee68d6dffbe91eafdda436a45b6aba104e723f18a0b778704591c5
SHA3-384 hash: 8a58215737b19d3c3318009ed9e7d3178731d37c054c4c0e7a35d6a33a1dd1fe3b37d1c6074afb4abe343388bc827833
SHA1 hash: 9b3ff6dd741ae2b23623f67e893fc6eaebd6bc10
MD5 hash: a588e06f3c9021bd57e8b0a5b459d3e3
humanhash: cardinal-diet-eighteen-black
File name:BREACHOFDATA.zip
Download: download sample
Signature ModiLoader
Create hunting rule
File size:562'438 bytes
First seen:2020-10-25 06:45:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:DhO57LCsNN8fUHIMG6mdQ80VAqAF80TV7q88aFqHP:iCO8fU5YQ8sAqAFBTV2dG+P
TLSH A6C423946C5AEF5E4E0750724BD0AEFACB15C48397939CE31A52E39C6DF322850F4C9A
Reporter abuse_ch
Tags:ModiLoader zip


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: ss0108.hostingcare.net
Sending IP: 64.37.50.170
From: disastercustomerservice <chudsi@ib.sahabinfo.com>
Reply-To: disastercustomerservice@sba.com
Subject: DATA BEACH
Attachment: BREACHOFDATA.zip (contains "BREACHOFDATA.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FZO4B198C9DF87C.32101.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/50deb8f0b6ee68d6dffbe91eafdda436a45b6aba104e723f18a0b778704591c5/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-10-25 01:09:27 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kdplr4fw5zunnx735epk7xneg2sfw2v2cbhhepyyuc3xq4cfshcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/50deb8f0b6ee68d6dffbe91eafdda436a45b6aba104e723f18a0b778704591c5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip 50deb8f0b6ee68d6dffbe91eafdda436a45b6aba104e723f18a0b778704591c5

(this sample)

ModiLoader

Executable exe 7ad833f9f06a7ebbad69a40515654c8a7a1b3346cf93214e2638e33901133409

  
Dropping
MD5 4b198c9df87ccd062a23a2702d6fe598
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7ad833f9f06a7ebbad69a40515654c8a7a1b3346cf93214e2638e33901133409

Comments