MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dfd06be71485f0afe2ae9225b079e21b5f0a756e3882f40302dbf56bfe11d89b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dfd06be71485f0afe2ae9225b079e21b5f0a756e3882f40302dbf56bfe11d89b
SHA3-384 hash: b1d98ca3676b694f7b36479faafbab5c58bd2ac7469843c53831730a99e328b0e2477876e63ab20281d5451893de1495
SHA1 hash: efc40f9f5999069e5621b3d024fa5ae6df87b3f1
MD5 hash: e25b251be638b6ef26d84642f7970cba
humanhash: fourteen-snake-alaska-venus
File name:file
Download: download sample
Signature ModiLoader
Create hunting rule
File size:413'851 bytes
First seen:2020-12-15 07:31:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Aln112oEWzhRYYNWU+AZMtWEn3ovWmFLvFmqSZg1sBXeNGF91npXoj92mCp7x:GvEWzs88YOmx8pZmnMllco
TLSH 289423898667866C0437C266A04286E31239D7DD66AC76DED5CFFEA4F1B13F1E0007AD
Reporter fabjer
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
147
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dfd06be71485f0afe2ae9225b079e21b5f0a756e3882f40302dbf56bfe11d89b/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-12-15 07:32:14 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=37igxzyuqxyk7yvosis3a6pcdnpqu5lohcbpiayc3p2wx7qr3cnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/dfd06be71485f0afe2ae9225b079e21b5f0a756e3882f40302dbf56bfe11d89b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip dfd06be71485f0afe2ae9225b079e21b5f0a756e3882f40302dbf56bfe11d89b

(this sample)

ModiLoader

Executable exe ff30b5d93f9eb3ec64ac203f9caafd54dd31677549a3aa484eb71db513fe8040

  
Dropping
SHA256 ff30b5d93f9eb3ec64ac203f9caafd54dd31677549a3aa484eb71db513fe8040
  
Delivery method
Distributed via e-mail attachment

Comments