MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 964ccfbaea71be83f9dba7b1c27f5c2a75210225d439666dc684886df98f643d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 964ccfbaea71be83f9dba7b1c27f5c2a75210225d439666dc684886df98f643d
SHA3-384 hash: 9ced5b7cbdd5f150124e9ff4296e08ab32154b2cd76e3d221f39f60380fbb15a81787d183c1c0e2500f316dda86a90fe
SHA1 hash: 362d5e37eef0f990bf1934c72275656defc9e2db
MD5 hash: a6138252d92a47945a7c5b227fac918f
humanhash: arkansas-zulu-muppet-mexico
File name:KQ20200618-VNMRPI20-1.zip
Download: download sample
Signature ModiLoader
Create hunting rule
File size:309'089 bytes
First seen:2020-10-06 18:16:13 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:JYd6YF17GhdHI86WPcRqqs8Uzae8ZGEdqfoasdHJdlH+ZnTkZpSw:JE6i17Gh9Pr00j8PeWGKqfoasdHJdlHL
TLSH 826423D63B8A5748A671CA3E2944BEA506A12BC942541327FFF75C642CF82E2437FB44
Reporter abuse_ch
Tags:ModiLoader zip


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: als.sparkmail.jp
Sending IP: 202.233.10.33
From: Caravel s.r.l. <carevel@caravel.it>
Subject: # Nova ordine confirmationis PO (MCMXII)DCLXXIX
Attachment: KQ20200618-VNMRPI20-1.zip (contains "KQ20200618-VNMRPI20-1.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/964ccfbaea71be83f9dba7b1c27f5c2a75210225d439666dc684886df98f643d/
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 13:04:21 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=szgm7oxkog7ih6o3u6y4e724fj2scarf2q4wm3ogqseg36mpmq6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/964ccfbaea71be83f9dba7b1c27f5c2a75210225d439666dc684886df98f643d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip 964ccfbaea71be83f9dba7b1c27f5c2a75210225d439666dc684886df98f643d

(this sample)

ModiLoader

Executable exe fda7edab2bfba6005bc2f82548b9dcef7deec1fef238acc5fee12322d2b2629e

  
Dropping
MD5 b58e3967fb6bc6081aaf35be8b744d11
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fda7edab2bfba6005bc2f82548b9dcef7deec1fef238acc5fee12322d2b2629e

Comments