MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 964fd8dc660ec31c018b0a597fecc7e947164e6e7b4612fefc456c2056ea2a21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 964fd8dc660ec31c018b0a597fecc7e947164e6e7b4612fefc456c2056ea2a21
SHA3-384 hash: c7e54e4f3456f090ce05f7fb1ca275c1812b162e4fc02a9830b0e19d36df85ae1a94292ca470de83e0a05514379853a0
SHA1 hash: e391d27dabb4cb9db6023934bdd4ae686136f83b
MD5 hash: b43bcc9ce2fc002efe2f8decb11b3217
humanhash: jig-indigo-nuts-fanta
File name:Order inquiry.rar
Download: download sample
Signature ModiLoader
Create hunting rule
File size:463'985 bytes
First seen:2020-11-06 07:36:25 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:PmI0O0KfJd2loi/umG0S4U1Mflm4gZsEmstxqZebYH1:9n0EJmG0S4IAo4gZsECZT
TLSH 38A423E0F143E678642F84B81283965D28C7EFC4A8D6539A9EF06CC90E3B658F445B78
Reporter abuse_ch
Tags:ModiLoader rar


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: alias8.gemini.surf
Sending IP: 185.192.245.17
From: Caecilia Egger <admin@gemini.surf>
Subject: RE INQUIRY
Attachment: Order inquiry.rar (contains "Order inquiry.com")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/964fd8dc660ec31c018b0a597fecc7e947164e6e7b4612fefc456c2056ea2a21/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 01:56:26 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=szh5rxdgb3bryamlbjmx73gh5fdrmttopndbf7x4ivwcavxkfiqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

rar 964fd8dc660ec31c018b0a597fecc7e947164e6e7b4612fefc456c2056ea2a21

(this sample)

ModiLoader

Executable exe 5df1620ac50ad894eb4777fb9e01f02971348ff7dc061b6519b0112bab041ae6

  
Dropping
MD5 3ecc987b0355454c2478c37143698d36
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5df1620ac50ad894eb4777fb9e01f02971348ff7dc061b6519b0112bab041ae6

Comments