MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa706c35dab0b6bacfafff6819c6a887cf2b8040d25163bc03517487dbcf91f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa706c35dab0b6bacfafff6819c6a887cf2b8040d25163bc03517487dbcf91f0
SHA3-384 hash: a16d59853f0b506597257e21e5531af7bfb3acb16ad921456c86cbe86b377b64f89e0ec01741092e5ad1a611cfac4462
SHA1 hash: 886ecafb855ef1555af83eda5a19a0379987d06a
MD5 hash: 670c8b831e32ffa479c8bf439696dc4a
humanhash: quebec-april-leopard-steak
File name:ScanIMG0001-PDF.z
Download: download sample
Signature ModiLoader
Create hunting rule
File size:561'545 bytes
First seen:2020-07-31 11:46:59 UTC
Last seen:2020-07-31 11:47:46 UTC
File type: z
MIME type:application/x-rar
ssdeep 12288:JnQMIKmE3GcFAag6ISgwjjtHEZLrNjlD0iHBZKmE3GcFAag6ISgwjjtHEZLrNjl3:JQIm2FRIMVEZNjWiym2FRIMVEZNjWih
TLSH 25C4235B1F282A9F12C6574D79B13C73DEA1C395242819A60D3C8B969232DE021B5FFF
Reporter abuse_ch
Tags:ModiLoader z


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: mail.greencc.com
Sending IP: 209.59.244.54
From: Tyler Simpson <tsimpson@greencc.com>
Subject: Urgent Purchase Order
Attachment: ScanIMG0001-PDF.z (contains "IMG_000002_DOCUMENTS_PDF.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fa706c35dab0b6bacfafff6819c6a887cf2b8040d25163bc03517487dbcf91f0/
Threat name:
Win32.Trojan.Bluteal
Create hunting rule
Status:
Malicious
First seen:
2020-07-31 11:48:09 UTC
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7jygyno2wc3lvt5p75ubtrviq7hsxaca2jiwhpadkf2ipw6pshya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fa706c35dab0b6bacfafff6819c6a887cf2b8040d25163bc03517487dbcf91f0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

z fa706c35dab0b6bacfafff6819c6a887cf2b8040d25163bc03517487dbcf91f0

(this sample)

ModiLoader

Executable exe 37c2608ad09b3f6d0cd33476b8f6bf6fefd1a0f2408657072da80a0454da7e6f

  
Dropping
MD5 c7089c992c256d32b1a788446baae7ed
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 37c2608ad09b3f6d0cd33476b8f6bf6fefd1a0f2408657072da80a0454da7e6f
  
Dropping
SHA256 54cdc9b1ede5661104e61f012de44e010500744c2b3003a6ffaff2f3f6eded34
  
Dropping
MD5 63fc3ff176598e20a9010d9015027f71

Comments