MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 899d573980c568a178fd0557b167dd07b073498c71c5cdb159147cc7b71636ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 899d573980c568a178fd0557b167dd07b073498c71c5cdb159147cc7b71636ae
SHA3-384 hash: 65bb4e3ba42db593c3c5f1f612804a407fa8660381b439bb40075de87e49d0e76806405dcd1f970377ed62d500b640ac
SHA1 hash: e018b7a29124b51dafac7ebf02a2932ec6e41dd8
MD5 hash: 1723c006f2fdbe9136a1ef8a1f1b6540
humanhash: winner-tennessee-solar-south
File name:7756740.gz
Download: download sample
Signature Loki
Create hunting rule
File size:247'518 bytes
First seen:2020-06-05 10:39:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:fKMd81qukQnW3G8I7P5zOU8HXcHGsOhe/xSCoD5Dumu+i:38k7zI7RqlAGsJ4CoZ1uX
TLSH 46342330F36F75C21C5941AC2632B4898E82D1E27574E997260FACEDE9BEB570900FD9
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: vps.boeschboddenspies.com
Sending IP: 45.95.169.119
From: 银行 <info@boeschboddenspies.com>
Reply-To: procurement@sincieremarine.com
Subject: PO 7405591/7756947/7756740需支付30％押金的发票
Attachment: 7756740.gz (contains "7756740.exe")

Loki C2:
http://clemglobal.com/server/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 11:35:34 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rgovoomayvukc6h5avl3cz65a6yhgsmmohc43mkzcr6mpnywg2xa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 899d573980c568a178fd0557b167dd07b073498c71c5cdb159147cc7b71636ae

(this sample)

Loki

Executable exe b6b6adb3244e332964a6dc4df71145564b82ab880dcbc89281858aa770fefe54

  
Dropping
MD5 5a84c48e5e7455424785cba6f3b9d227
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b6b6adb3244e332964a6dc4df71145564b82ab880dcbc89281858aa770fefe54

Comments