MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 627a0042ab7029f6a685950008b3059b6d6d7e710861fbb378d4d898056ec69a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 627a0042ab7029f6a685950008b3059b6d6d7e710861fbb378d4d898056ec69a
SHA3-384 hash: 6c5096bda2ad8d1eb61c86f6e79f3583ce38704833dbfa4011a51250cbafc1bc4b1702a2176e812a2c75c489111c63c4
SHA1 hash: 93d85bbcc53046b670abc1cd1bba34fdd5aa05ee
MD5 hash: 0c6da03f3230a61095aff9ddeac5dbd2
humanhash: hot-moon-cup-tennessee
File name:Outstanding payment_ IVTJ20000686 AND IVTJ20000687.zip
Download: download sample
Signature Loki
File size:430'529 bytes
First seen:2020-07-31 11:17:23 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:iCZ67yjlSJrlSqvbe2Sr6Lf9NOhzmyr7CZWnbiicZdmACotFEYuebd3DYW3Zgu3q:iCIGjlIXvX9NyfbiNrzf3x1XW
TLSH 3C94232CE273B5A1445AD0DCC2331A99BAB83569B30F1C66817B41F2DBD65FC6983DA0
Reporter @abuse_ch
Tags:Loki zip


Twitter
@abuse_ch
Malspam distributing Loki:

HELO: bck.a2u2.com
Sending IP: 199.195.146.246
From: a.zhunysova@shanyrak-group.kz
Subject: Outstanding payment_ IVTJ20000686 AND IVTJ20000687
Attachment: Outstanding payment_ IVTJ20000686 AND IVTJ20000687.zip (contains "Outstanding payment_ IVTJ20000686 AND IVTJ20000687.exe")

Loki C2:
http://sieqwarteg.com/chief/chief2/fre.php

Intelligence


File Origin
# of uploads :
1
# of downloads :
32
Origin country :
US US
Mail intelligence
Geo location:
Global
Volume:
Low
Vendor Threat Intelligence
Threat name:
Win32.Infostealer.Fareit
Status:
Malicious
First seen:
2020-07-31 11:19:05 UTC
AV detection:
25 of 48 (52.08%)
Threat level
  5/5
Threat name:
Malicious File
Score:
1.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 627a0042ab7029f6a685950008b3059b6d6d7e710861fbb378d4d898056ec69a

(this sample)

  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment

Comments