MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1cbda346cc270d7683d7566e000dd31ea54e14500a8ddf76964a140e75bc3954. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1cbda346cc270d7683d7566e000dd31ea54e14500a8ddf76964a140e75bc3954
SHA3-384 hash: 6d88d3e9911ea3ab3bf8bc40d4f9553fc9aafbc1529617b3370ac92b16ea812c2c8f87e5614bf28d6ddd41232f3b0f90
SHA1 hash: bb61f233ec56823fcd1f491b314808a2883608c8
MD5 hash: f16852aea03ed1bff92fac94d3705437
humanhash: steak-paris-maine-illinois
File name:copy file-4014014_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:446'102 bytes
First seen:2020-07-22 07:16:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:kSXVuaugO/ugiU7d/8fXJACO1r+6y3xct08eEZkcQ5+kC+FBBPrI3C2lj+yOV3oV:kiVua/U7yBAyhpEZkZFFB1ECSjoaIW
TLSH 8C9423EECFE5235546520B3C4B8A7CB3FC6AD949118FFDE9872BF2483049A05707661A
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: angloeastern.com
Sending IP: 103.99.1.147
From: Ms. Norarfah Omar<omarn@angloeastern.com>
Subject: Inquiry for supply of Fuel Oil
Attachment: copy file-4014014_pdf.gz (contains "copy file-4014014_pdf.exe")

Loki C2:
http://brokenbones.ga/Colba4/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.Delf.FareIt.Gen.7.11988.27959.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1cbda346cc270d7683d7566e000dd31ea54e14500a8ddf76964a140e75bc3954/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 01:16:09 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ds62grwme4gxna6xkzxaadotd2su4fcqbkg565uwjika45n4hfka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1cbda346cc270d7683d7566e000dd31ea54e14500a8ddf76964a140e75bc3954

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 1cbda346cc270d7683d7566e000dd31ea54e14500a8ddf76964a140e75bc3954

(this sample)

Loki

Executable exe ab986524b5bf9434296a01cba5f2c36ba731946e8e39b6ff362c3a7ce7483353

  
Dropping
MD5 9879cd77f109572d3aeb5cad1e5fc459
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ab986524b5bf9434296a01cba5f2c36ba731946e8e39b6ff362c3a7ce7483353

Comments