MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 065538878b1dd6bcb18b25fb879827459c126aaf0864673800239594a80af075. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 065538878b1dd6bcb18b25fb879827459c126aaf0864673800239594a80af075
SHA3-384 hash: eae3241ee16e3c2dd258ae07f2e1982879982dd6c1fb2d8cf7bcd654a718f05fe8cc4e90218b281e9370b9bc657e78cf
SHA1 hash: 0922d6d20e58899bb83efeb78e24a338cfd2e264
MD5 hash: c41c9851f409f9f88e747114e36fdec0
humanhash: bacon-network-leopard-angel
File name:Updated Heavy Duty Equipments Price List_pdf.z
Download: download sample
Signature Loki
Create hunting rule
File size:305'015 bytes
First seen:2020-07-02 06:34:29 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:P7L6Ft4A9k9NJ7hu0ldCJL3lEJ+tXOsufLhtVO+RaWPXo:zL6Fu9N5hjGLE+XYfLhOsjXo
TLSH C154232D689D199281CE307C7337926A5FC1BEC64F5ED46F77AD02BAC62A0B70716640
Reporter abuse_ch
Tags:Loki z


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.bengiamein.gq
Sending IP: 64.52.173.45
From: RMA GROUP <sales@rmagroup.com>
Subject: INQUIRY FOR HEAVY DUTY EQUIPMENTS
Attachment: Updated Heavy Duty Equipments Price List_pdf.z (contains "Updated Heavy Duty Equipments Price List_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/065538878b1dd6bcb18b25fb879827459c126aaf0864673800239594a80af075/
Threat name:
Win32.Trojan.DelfFareIt
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 06:35:52 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=azktrb4ldxllzmmlex5ypgbhiwobe2vpbbsgooaaeokzjkak6b2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z 065538878b1dd6bcb18b25fb879827459c126aaf0864673800239594a80af075

(this sample)

Loki

Executable exe b0ec0a159d5f201b2a96c4913c637c278a98f1cb67c7e9d38841907323cdd51f

  
Dropping
MD5 0546334fb13e04e60d3960f6673463db
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b0ec0a159d5f201b2a96c4913c637c278a98f1cb67c7e9d38841907323cdd51f

Comments