MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5aefb7a2d5e2c777f0da2144e44a6cfa9549ff8e5046bfb806a879f66e353f03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5aefb7a2d5e2c777f0da2144e44a6cfa9549ff8e5046bfb806a879f66e353f03
SHA3-384 hash: a0689c232ea8cc19bfe3b5a6c811391846c4bdd0195c565100c70d3ac43ce89a678c597f07c7438cdde0c112d60256f6
SHA1 hash: 134d03653443466466e8d155c2d56aad116a119a
MD5 hash: 3eba8fba658ae9221440286524124fb3
humanhash: coffee-lemon-romeo-fish
File name:Lista de nuevos pedidos.zip
Download: download sample
Signature ModiLoader
Create hunting rule
File size:371'475 bytes
First seen:2021-03-31 06:54:22 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Tk+x6xTl8A4L+bfts8t+DC1cGLm4prBje15DHM/3A3nE7+xOpjQ707n9:TBcxh8HKC8t+xGLFpB611s/t+xOpe0b9
TLSH 908423BF0F2644DBF6263A750C75CF055CFF642104E97EE3F5812A5AB0DB48228E9254
Reporter abuse_ch
Tags:ESP geo zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: fefdd5f.online-server.cloud
Sending IP: 82.165.202.84
From: Arturo Castro <arturocascan@gmail.com>
Subject: Re: Re: Re:Re:Re:Re: Nuevo orden
Attachment: Lista de nuevos pedidos.zip (contains "Lista de nuevos pedidos.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/5aefb7a2d5e2c777f0da2144e44a6cfa9549ff8e5046bfb806a879f66e353f03
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5aefb7a2d5e2c777f0da2144e44a6cfa9549ff8e5046bfb806a879f66e353f03/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-31 04:09:05 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=llx3piwv4ldxp4g2efcoistm7kkut74okbdl7oagvb47m3rvh4bq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/5aefb7a2d5e2c777f0da2144e44a6cfa9549ff8e5046bfb806a879f66e353f03

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip 5aefb7a2d5e2c777f0da2144e44a6cfa9549ff8e5046bfb806a879f66e353f03

(this sample)

ModiLoader

Executable exe c32dee06d3afee022d74b45536699ed2d6458d39dff35d4830cb9febecdb8143

  
Dropping
MD5 3dc09b272c666a298915d94e612f4763
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c32dee06d3afee022d74b45536699ed2d6458d39dff35d4830cb9febecdb8143

Comments