MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba9bfb0d60c82a7089416526c12c14a7bb094918d3b1238ff7ef84871168308e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba9bfb0d60c82a7089416526c12c14a7bb094918d3b1238ff7ef84871168308e
SHA3-384 hash: e9b3b9164385444dff068ff80d5b83560b8a67ab31b8c2e165173edef7f754b64ec882a630293583d31455c981d4e532
SHA1 hash: 6f3b5484c7f8ef1e7b40286f0015802c999c2ad5
MD5 hash: da596d5fdc4f69e57e6a2fdae73e0090
humanhash: charlie-stream-crazy-tennis
File name:Scan_Docs INV 300489739-04-08-2020 Amended.r00
Download: download sample
Signature ModiLoader
Create hunting rule
File size:496'600 bytes
First seen:2020-08-05 09:26:35 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:gAlXMnJ+kue07vbzA9DYXi3m3T+NEjQSvCS9cI:gAlXMJ+jzziY9OEjhvl9b
TLSH 42B4334DB7B797784B388D838A46165178E9F12C27CB0F8015AEE4E0E07DB57A4F43A6
Reporter abuse_ch
Tags:ModiLoader r00


Avatar
abuse_ch
Malspam distributing ModiLoader:

From: "Sandeep Manohar (GAM)" <sandeepm@tukatech.com>
Subject: RE: Richa Global (219,Ggn) - AMC Docs reference INV
Attachment: Scan_Docs INV 300489739-04-08-2020 Amended.r00 (contains "Scan_Docs #INV 300489739-04-08-2020 Amended.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba9bfb0d60c82a7089416526c12c14a7bb094918d3b1238ff7ef84871168308e/
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 07:11:46 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xkn7wdlazavhbckbmutmclauu65qssiy2oyshd7x56cioeligcha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ba9bfb0d60c82a7089416526c12c14a7bb094918d3b1238ff7ef84871168308e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

r00 ba9bfb0d60c82a7089416526c12c14a7bb094918d3b1238ff7ef84871168308e

(this sample)

ModiLoader

Executable exe e7a5b30eb4ad9f5b7b53bd402756a623c67cfb8d46d1148b40d8bc2d4ea43594

  
Dropping
MD5 3df05e1f4f5c951d52524eb426bb9a3f
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e7a5b30eb4ad9f5b7b53bd402756a623c67cfb8d46d1148b40d8bc2d4ea43594

Comments