MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1bbe115f43c884a6984f70bc4a169ea14303a866d7f405476de6901178f23162. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1bbe115f43c884a6984f70bc4a169ea14303a866d7f405476de6901178f23162
SHA3-384 hash: 7a960c67f3188be634a72352d03e8ee0f301ca240b8ef00a2c22f2a60dbdd68bf42f9ec008231b749849ae9b69f00fb3
SHA1 hash: 0f0fb9cc7770495a2242e96dacf5a5bc68184843
MD5 hash: fb8cf11adb28738758a80989a0085b8f
humanhash: fanta-leopard-violet-stairway
File name:ANMODNING OM TILBUD 2-7-2020_pdf.rar
Download: download sample
Signature Loki
Create hunting rule
File size:307'398 bytes
First seen:2020-07-02 12:33:30 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:oRPp1bMNd+F+NX3NXUne8rs5U8STi+Ygx0IrNCwgM3DXJfnWtheTTthzBob1:oRx1QdZNHNXr2rTCgx0IrNiM3da0hWb1
TLSH ED64231AE9F861D4F7D99B208FC503EF9733E8828FE4035D3B35999620A5B935C46E48
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: metheksis.gr
Sending IP: 5.9.14.91
From: Ollscoil Chathair Bhaile Átha Cliath <admin@dcu.ie>
Subject: IARRATAS AR CHEID (Ollscoil Chathair Bhaile Átha Cliath)
Attachment: ANMODNING OM TILBUD 2-7-2020_pdf.rar (contains "upadted_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1bbe115f43c884a6984f70bc4a169ea14303a866d7f405476de6901178f23162/
Threat name:
Win32.Trojan.DelfFareIt
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 12:35:06 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=do7bcx2dzcckngcpoc6eufu6ufbqhkdg272akr3n42ibc6hsgfra._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 1bbe115f43c884a6984f70bc4a169ea14303a866d7f405476de6901178f23162

(this sample)

Loki

Executable exe e6185bd50b78a2280181337e32864577d4650b7923eb64e8e95f85d46be4ced0

  
Dropping
MD5 0124d93385c8a6398f72daa6997f49c8
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e6185bd50b78a2280181337e32864577d4650b7923eb64e8e95f85d46be4ced0

Comments