MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba6498aee9c3f96a43e55c23390d071466710940537ec651679b7451ab228e91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba6498aee9c3f96a43e55c23390d071466710940537ec651679b7451ab228e91
SHA3-384 hash: 2ecf57ccbbfab0922115714afa249aa673a912edaf9e7d210c6937efe2d577e19f853f36274958e2e986dd863561e493
SHA1 hash: 3ce548319b1d4fbbcca8bfe6f552c5a84ba711e1
MD5 hash: ec16695a8f38d687ba27a4fe76612df2
humanhash: fruit-zebra-two-freddie
File name:Tuticorin Berth Shipment Invoices Recorded_AUG 2020.r00
Download: download sample
Signature ModiLoader
Create hunting rule
File size:335'780 bytes
First seen:2020-08-17 13:53:19 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:MaADy54M2LJzTbOl/QnD0ns5ef4hvpjvFajX6qZY0l3cTNjIPLTt+xSdeISM43H6:lADyB2Z0YD0nc00jkPLld6MgwX
TLSH BE64239EAB5B6CA247937844A52BDC3CB9325D1A7015893BF2C677527B3C4423093FCA
Reporter abuse_ch
Tags:ModiLoader r00


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: muduvaali.com
Sending IP: 185.222.58.146
From: Muduvaali <info@muduvaali.com>
Subject: RI: Invoice Copy (MV NIUMATH) - Aug 2020 Berth
Attachment: Tuticorin Berth Shipment Invoices Recorded_AUG 2020.r00 (contains "Tuticorin Berth Shipment Invoices Recorded_AUG 2020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba6498aee9c3f96a43e55c23390d071466710940537ec651679b7451ab228e91/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xjsjrlxjyp4wuq7flqrtsdihcrthcckakn7mmulhtn2fdkzcr2iq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ba6498aee9c3f96a43e55c23390d071466710940537ec651679b7451ab228e91

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

r00 ba6498aee9c3f96a43e55c23390d071466710940537ec651679b7451ab228e91

(this sample)

ModiLoader

Executable exe 5676023342556347feed6d6f487a3ad4e8820b84f2f80e71d343acf42b9e54f1

  
Dropping
MD5 805afc559903e221cebffad7f350ab2c
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5676023342556347feed6d6f487a3ad4e8820b84f2f80e71d343acf42b9e54f1

Comments