MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a49a245339637dbf53a5500b04167950113c07b2eb9851ed864206fb7cb43446. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a49a245339637dbf53a5500b04167950113c07b2eb9851ed864206fb7cb43446
SHA3-384 hash: 005dcd4982d976faa73870acf2f6180deba17b2e5e5e446eee35fe30133abb30186201243f3096f672b10f91c47d3f76
SHA1 hash: 8641a28ea07d51c4c056973a19f0ee78fbb07802
MD5 hash: b3a5d8aed967e658f6ca05126b2b960b
humanhash: speaker-music-grey-march
File name:NewOrder-202008-pdf.z
Download: download sample
Signature ModiLoader
Create hunting rule
File size:241'926 bytes
First seen:2020-08-14 10:33:24 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:Gh9Liae+91WaJawuBusVh+SpMf3YZQjusecKWiRIILgJ:mzgDH+zSRV4
TLSH 24342302C8856801FCF5EF1679AF45DE4DD8A8EC88810FDA465B1C334A84FD6B1B9C9B
Reporter abuse_ch
Tags:ModiLoader z


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: WIN-NBJLMJG42OT
Sending IP: 45.137.22.57
From: Mariah Gonzales <info@bgsco.net>
Subject: PURCHASE ORDER
Attachment: NewOrder-202008-pdf.z (contains "NewOrder-202008-pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a49a245339637dbf53a5500b04167950113c07b2eb9851ed864206fb7cb43446/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-08-14 10:35:06 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=usnciuzzmn636u5fkafqiftzkaityb5s5omfd3mgiidpw7fugrda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a49a245339637dbf53a5500b04167950113c07b2eb9851ed864206fb7cb43446

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

z a49a245339637dbf53a5500b04167950113c07b2eb9851ed864206fb7cb43446

(this sample)

ModiLoader

Executable exe b1e43124a401714ce72691a059cfaf3182e0e63986ab8e165d8333bf11540568

  
Dropping
MD5 8152535e957820c4977d19f87ff3ed1c
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b1e43124a401714ce72691a059cfaf3182e0e63986ab8e165d8333bf11540568

Comments