MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87943c74c5d920ae13509cc7c9788c39f83df3c48be7cabb695988a6cae5f9f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87943c74c5d920ae13509cc7c9788c39f83df3c48be7cabb695988a6cae5f9f9
SHA3-384 hash: 46c248415da7d7aa8cfebcdb00cbec52cc685ee892770c9e468e877eb8a37a77c7dfdc610fa3465865dd74ae84062cb6
SHA1 hash: 4cef4d9a7389267536cd3fcbb6404aadc5c212fe
MD5 hash: 7761e00e82b9bf65c0d9f8daa49337c8
humanhash: sixteen-burger-violet-delaware
File name:Quotataion Request.zip
Download: download sample
Signature Loki
Create hunting rule
File size:355'359 bytes
First seen:2020-07-19 10:23:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:aZ1+BeITI8OIOwdo708+h4DPBVtSS8NBnOVgiW0jj:rBeI8ItC0h4zBCSyBOV9zjj
TLSH 3A742323B256F0121BE7E254F1F8C68C461B921C7AD7BC9D1C5B2A1CC741FA8A13F226
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.optanet.hu
Sending IP: 85.90.180.2
From: LAMYA AL-QAHTANI <eurokun@optanet.hu>
Subject: Request for quotation No : 7461
Attachment: Quotataion Request.zip (contains "Quotataion Request.exe")

Loki C2:
http://eloquentcs.com/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/87943c74c5d920ae13509cc7c9788c39f83df3c48be7cabb695988a6cae5f9f9/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-19 10:25:05 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q6kdy5gf3eqk4e2qttd4s6emhh4d346erpt4vo3jlgeknsxf7h4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/87943c74c5d920ae13509cc7c9788c39f83df3c48be7cabb695988a6cae5f9f9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 87943c74c5d920ae13509cc7c9788c39f83df3c48be7cabb695988a6cae5f9f9

(this sample)

Loki

Executable exe b7a17727462906ac85e4082ac63a7a3884e67c222e36e9696e445b3ff882bf28

  
Dropping
MD5 040e497c26b9609145715352da4e76d1
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b7a17727462906ac85e4082ac63a7a3884e67c222e36e9696e445b3ff882bf28

Comments