MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3638e9009fd0e4ec944fc9a2ece973a13d840f009df1d26a03d5698d7a4b4a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3638e9009fd0e4ec944fc9a2ece973a13d840f009df1d26a03d5698d7a4b4a7
SHA3-384 hash: 7d6b2229871031ff3f3a2b4f98c4c326a93d2420bfdd111bc192b696d234d879005bdd6cdef000970c54e06a3b0f43cf
SHA1 hash: 736b128237f03716456bd22b1db0ae354f1b043e
MD5 hash: 8510a1217a3a28898e311e6c01d36b95
humanhash: lion-oranges-music-diet
File name:Novi poredak.zip
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'410'653 bytes
First seen:2020-11-28 09:20:30 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:o00q/0yMyzn5kpS4aBn6ShsproluqOP+iuqhYEnTxSV2ddlb48ahLfYwywOVxNFu:h/jzn5zkrolLKTWoDdl/s3hE9tA
TLSH 5D6533903C742309C67965B0400E9634E3B6AD75E808B54F36D4BFB569BAC2F73D78A2
Reporter abuse_ch
Tags:geo HRV zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.urdisc.com.ua
Sending IP: 193.227.96.6
From: Vatroslav Vujičić <vatroslav.vujicic@dpd.hr>
Subject: Re: Novi poredak
Attachment: Novi poredak.zip (contains "Novi poredak.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3638e9009fd0e4ec944fc9a2ece973a13d840f009df1d26a03d5698d7a4b4a7/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-11-28 01:36:42 UTC
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wnry5eaj7uhe5ske7snc5tuxhij5qqhqbhpr2jvahvljrv5ewstq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip b3638e9009fd0e4ec944fc9a2ece973a13d840f009df1d26a03d5698d7a4b4a7

(this sample)

ModiLoader

Executable exe 2446476e9008d7e3c9f908680c22794aad6c26605536ec0cb428b33c99f72be3

  
Dropping
MD5 99a04fddbcdadcc10efa80d863d96d30
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2446476e9008d7e3c9f908680c22794aad6c26605536ec0cb428b33c99f72be3

Comments