MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb679e72a3d34322e9e710b86cb840f1c21c4a2bc7669c8a2e17049e95be71a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb679e72a3d34322e9e710b86cb840f1c21c4a2bc7669c8a2e17049e95be71a8
SHA3-384 hash: a63c5bea1548b8a988289e69686cced88288950cbdf12d3155d0880957e89d5de46e011a081f3852657e6805ed320efb
SHA1 hash: 46ce7d92ae8186c25b237e2a363cb9743b974458
MD5 hash: c2754ac65bb0c398cc9c847679b71ddf
humanhash: idaho-seventeen-arizona-fruit
File name:TUR Request Confirmation876789376TD_PDF.7z
Download: download sample
Signature ModiLoader
Create hunting rule
File size:341'798 bytes
First seen:2020-10-20 08:09:43 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:4icg2GbUGtKNK8STR/YWjLdVEvweWEAOTz+CORFWlOW//xYQSDnIo:DiGtLThYW3CASaCORF1WHxYQsn1
TLSH 2174234AB46F5BA522248DDB6C6C1411EDC8EDE50C6FC54CBF02357F20A6094ADBDCE6
Reporter abuse_ch
Tags:7z ModiLoader


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: bas0.nida-logistics.com
Sending IP: 45.86.74.124
From: AYDIN Erdal <contact@nida-logistics.com>
Subject: ARSİ TURİZM Request Order - OCT2020
Attachment: TUR Request Confirmation876789376TD_PDF.7z (contains "TUR Request Confirmation876789376TD_PDF.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb679e72a3d34322e9e710b86cb840f1c21c4a2bc7669c8a2e17049e95be71a8/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ntz44vd2nbsf2phcc4gzoca6hbbysrly5tjzcroc4cj5fn6ogua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fb679e72a3d34322e9e710b86cb840f1c21c4a2bc7669c8a2e17049e95be71a8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

7z fb679e72a3d34322e9e710b86cb840f1c21c4a2bc7669c8a2e17049e95be71a8

(this sample)

ModiLoader

Executable exe 698a3c667ded86b3422b8e4839c9ca2743a8c4905fbc449514e59a9b666bda4d

  
Dropping
MD5 de8007c16d5e29a57c6004c6bb8c7100
  
Dropping
ModiLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 698a3c667ded86b3422b8e4839c9ca2743a8c4905fbc449514e59a9b666bda4d

Comments