MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60d4eed190019c380053e2934059d757d2394953b77c9f1d4955e1864d4ebfa4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60d4eed190019c380053e2934059d757d2394953b77c9f1d4955e1864d4ebfa4
SHA3-384 hash: 4262ce82944ca66ac7fe61e672171fc17dd2b0147d710a868eb21297b34cfcfb42fd33635f777a649c8ac3c656f8441c
SHA1 hash: 3f6e7919c6d9dc5a47647c804533d3371ffd322e
MD5 hash: 89103b1be521c65edc060ef2c2bb6269
humanhash: sad-robin-red-india
File name:SCN23864.gz
Download: download sample
Signature ModiLoader
Create hunting rule
File size:457'525 bytes
First seen:2020-09-22 05:22:40 UTC
Last seen:2020-09-22 05:42:42 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:45tVohFDg+daEAWHJiI/y8MuIJk0jLK3mkWIJDqZzzEkxh:i4y+YZWpiAiFkFNSzzzxh
TLSH AAA423007BB7304AAFDD1D4DB3039E0D6178A4668113BAF453854D4B7CBDAB28BD26A9
Reporter GovCERT_CH
Tags:ModiLoader

Intelligence

File Origin
# of uploads :
3
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.23890.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/60d4eed190019c380053e2934059d757d2394953b77c9f1d4955e1864d4ebfa4/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-09-22 05:19:48 UTC
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mdko5umqagodqact4kjuawoxk7jdssktw56j6hkjkxqymtkox6sa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/60d4eed190019c380053e2934059d757d2394953b77c9f1d4955e1864d4ebfa4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip 60d4eed190019c380053e2934059d757d2394953b77c9f1d4955e1864d4ebfa4

(this sample)

ModiLoader

Executable exe 5b9ece9761c68e4a604443f7541a1de74282f19a49f347a56a9ea4f02855f866

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5b9ece9761c68e4a604443f7541a1de74282f19a49f347a56a9ea4f02855f866
  
Dropping
MD5 67a6323ccb5c3b7aefadcf6df7f36b5d

Comments