MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e8015c98c777e580d5abbfd01c1dcc7bf05f66db5b926949434d74abbffc163. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e8015c98c777e580d5abbfd01c1dcc7bf05f66db5b926949434d74abbffc163
SHA3-384 hash: b44940b34bf95f79e3bed546d03d6c50f69af70502c287a5e7ac7fc1a4284be8820d1ee7c50cd87008b0c5ad8fd8a562
SHA1 hash: 474ba2d00dc338b8b7e842c12037e4aaf549b9e6
MD5 hash: 8252a95006aed9e31ffb8ae95a0cdeb2
humanhash: violet-skylark-november-tennessee
File name:PO.rar
Download: download sample
Signature ModiLoader
Create hunting rule
File size:607'095 bytes
First seen:2020-10-14 15:37:23 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:FlTCLAgjoJV+C5OlzDCuEDI5BiTbQPpkx1YDnCoLyTsjWFTHNWu66qY:z+LAPJA1lzDZE4iPskvYz5yTsMTHIurb
TLSH EFD423EF4A512BD27C85995E802EFD05D8E345D6C297AE0B1E58C702C0D3FDE1B9B498
Reporter abuse_ch
Tags:ModiLoader rar


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: wooridash.localdomain
Sending IP: 211.210.154.22
From: Comercial FBM C.A.<zhaotai@zhaotai.com.cn>
Reply-To: <comercial_cedana@yahoo.com>
Subject: Inquiry to ECUADOR
Attachment: PO.rar (contains "PO.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e8015c98c777e580d5abbfd01c1dcc7bf05f66db5b926949434d74abbffc163/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 01:41:38 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n2ablsmmo57fqdk2xp6qdqo4y67ql5tnww4snfeugtluvo77yfrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6e8015c98c777e580d5abbfd01c1dcc7bf05f66db5b926949434d74abbffc163

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

rar 6e8015c98c777e580d5abbfd01c1dcc7bf05f66db5b926949434d74abbffc163

(this sample)

ModiLoader

Executable exe 38440f87298bc526e58264d7507e0049c2a3e79453d1009617f68935709b0adc

  
Dropping
MD5 83befbfa8fb16821b8b985b17fe50ce3
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 38440f87298bc526e58264d7507e0049c2a3e79453d1009617f68935709b0adc

Comments