MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55ad2a976f26d7c44e6bd1a17b1eb9651c729020eb7a8bedf17d29d172b8c764. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 55ad2a976f26d7c44e6bd1a17b1eb9651c729020eb7a8bedf17d29d172b8c764
SHA3-384 hash: 6c11c671ffb92366f79839b63b9cedc5419e64e93cb2d4ee50a0f93cb0f091f10a055d0bfb093152b006ef6754b345e7
SHA1 hash: 51c9a743153a772357ea1b8e38d58540ab1fd2cc
MD5 hash: a39c52c33c8c813d73a778c3fce365d6
humanhash: carbon-vermont-cold-butter
File name:Loagffd_Signed_.rar
Download: download sample
Signature ModiLoader
Create hunting rule
File size:506'032 bytes
First seen:2020-10-13 17:51:39 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:hHGCAhIjI/I8YOgKeMtBJiei86DN31W9znCfWuzwirGr7Efr1K:KIjoI8YtjMe86SVCfWuzBfr1K
TLSH 4EB4239ACB79DB3268C0F60171C070B19A3CAF0BD3D95F972B586179148C2346B9EAF5
Reporter abuse_ch
Tags:ModiLoader rar Yahoo


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: sonic315-15.consmr.mail.bf2.yahoo.com
Sending IP: 74.6.134.125
From: Alfred <alfredlvbz@yahoo.com>
Subject: Re: Order
Attachment: Loagffd_Signed_.rar (contains "Loagffd_Signed_.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/55ad2a976f26d7c44e6bd1a17b1eb9651c729020eb7a8bedf17d29d172b8c764/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 16:19:29 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kwwsvf3pe3l4ittl2gqxwhvzmuohfeba5n5ix3prpuu5c4vyy5sa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/55ad2a976f26d7c44e6bd1a17b1eb9651c729020eb7a8bedf17d29d172b8c764

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

rar 55ad2a976f26d7c44e6bd1a17b1eb9651c729020eb7a8bedf17d29d172b8c764

(this sample)

ModiLoader

Executable exe 3a922a41c854b9a51b2ac3b504076bb02707087816a59e4225ca592cdff4ad24

  
Dropping
MD5 08a03aade09418199ea68bec7cec34cd
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3a922a41c854b9a51b2ac3b504076bb02707087816a59e4225ca592cdff4ad24

Comments