MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec26a95d2d97ac988e63e14ff4919e6bf3431ef0073f13ec3cace744ac4fdce9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec26a95d2d97ac988e63e14ff4919e6bf3431ef0073f13ec3cace744ac4fdce9
SHA3-384 hash: c75f250e1d48a5c51be117cdb8fd900096cf15f3aa1ba6c422ec11d1b4cf11821594af2e91d71d3a513613bc435268c7
SHA1 hash: 0e76e797c44d966b364174175390d48853773c44
MD5 hash: 632210836488ba556144c13d27e133b2
humanhash: pizza-stairway-network-uncle
File name:December SOA.cab
Download: download sample
Signature ModiLoader
Create hunting rule
File size:253'590 bytes
First seen:2021-01-04 13:17:25 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:5gHHVvCidnF5V++Un957DetAdW7kJmj6tnY9ZXMMQgJmAQNpR+c14:0FP529DW7kw+VoM5gJcR+B
TLSH D44422FFD2E2098A2711C64579FBC0B6B674DFAD123B33164E6A18E2D78B5149C38E41
Reporter abuse_ch
Tags:cab


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.pncomposite.com
Sending IP: 203.76.124.211
From: commercial.custom@pncomposite.com
Subject: RE: SOA.
Attachment: December SOA.cab (contains "December SOA.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
347
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ec26a95d2d97ac988e63e14ff4919e6bf3431ef0073f13ec3cace744ac4fdce9/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-01-04 13:18:05 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5qtksxjns6wjrdtd4fh7jem6npzughxqa47rh3b4vttujlcp3tuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ec26a95d2d97ac988e63e14ff4919e6bf3431ef0073f13ec3cace744ac4fdce9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

rar ec26a95d2d97ac988e63e14ff4919e6bf3431ef0073f13ec3cace744ac4fdce9

(this sample)

ModiLoader

Executable exe 383d80ef71e1bd484b6838e3c89eebca3bea49ef0648d3a79564c87aa6ddc00f

  
Dropping
MD5 eeb02ab3b51a522164e83aafa98494e3
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 383d80ef71e1bd484b6838e3c89eebca3bea49ef0648d3a79564c87aa6ddc00f

Comments