MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5c2bc0c565e352e7ba0e68c0ba788349de2a3bb0c4cb9c023e6d3c0cdb3ce18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5c2bc0c565e352e7ba0e68c0ba788349de2a3bb0c4cb9c023e6d3c0cdb3ce18
SHA3-384 hash: 7fa304f3f14d7692617a0735e2cfce733cdbd2d87efe80a8b29235bae5b5cdd66afcf077dc5e8e7776a16f40933383c4
SHA1 hash: 6fead51b8f21f6e1dd0cee200d76f8cb87f8a42d
MD5 hash: eb79392ef87775def27c72112e394160
humanhash: steak-october-hot-low
File name:INVOICE.img
Download: download sample
Signature ModiLoader
Create hunting rule
File size:679'936 bytes
First seen:2020-12-26 08:11:26 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:G0O9si66PFSav1nfcja/P4Tulz6dOG6767a9SwiscMnw:G0a+6UOfCa/A/6767aP2V
TLSH 72E48F62B3D0897BD513EE78BC0BA3B098397D903D2964457AE619BC4F78350392F1A7
Reporter abuse_ch
Tags:img ModiLoader


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: neurosurgery.or.kr
Sending IP: 118.128.190.141
From: Regina Lambertz (Financial Accounting) <kfn3@kfn.or.kr>
Subject: *URGENT* PAYMENT DETAILS 23/12/2020
Attachment: INVOICE.img (contains "INVOICE.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
550
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1493.UNOFFICIAL
Create hunting rule

Win.Trojan.Generic-9816732-0
Create hunting rule

PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

PUA.Win.Adware.Qjwmonkey-6892535-0
Create hunting rule

SecuriteInfo.com.Fareit-FZOA93AF1E2096C.23549.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b5c2bc0c565e352e7ba0e68c0ba788349de2a3bb0c4cb9c023e6d3c0cdb3ce18/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-12-26 08:12:06 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wxblydcwly2s465a42gaxj4igso6fi53brgltqbd43j4btntzyma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b5c2bc0c565e352e7ba0e68c0ba788349de2a3bb0c4cb9c023e6d3c0cdb3ce18

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

img b5c2bc0c565e352e7ba0e68c0ba788349de2a3bb0c4cb9c023e6d3c0cdb3ce18

(this sample)

ModiLoader

Executable exe 89ca0ea25e05983099ae8221becde0d57c5528d85d6ab8fd944f7c941437d679

  
Dropping
MD5 319e34bf7ecf5c74e8c192be57093d96
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 89ca0ea25e05983099ae8221becde0d57c5528d85d6ab8fd944f7c941437d679

Comments