MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a57e2dfc39ff15ffe1304c2e413dd9275a25b37d2d741a746655539f585fda78. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a57e2dfc39ff15ffe1304c2e413dd9275a25b37d2d741a746655539f585fda78
SHA3-384 hash: db4ad7b99b9aaa7429384d31d35e85abb0590a0eb42a8e6187b5af773c3cc8072571f631aeb21753f71899d28340699e
SHA1 hash: ce90b795d42c0ea25533916d07544c022da28758
MD5 hash: aa9f64f26e84b69f627982350db2def4
humanhash: chicken-delaware-massachusetts-harry
File name:DHL Receipt.pdf.z
Download: download sample
Signature Loki
Create hunting rule
File size:304'955 bytes
First seen:2020-07-02 12:28:22 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:U86Ft4A9k9NJ7hu0ldCJL3lEJ+tXOlMPlp+CiBEj/OaAk:z6Fu9N5hjGLE+Xv27G2a3
TLSH C754230B29351F0153C676F423B6644F5AD6FFD5CB5F4C2221AEABBF6AE61090711282
Reporter abuse_ch
Tags:DHL geo GRC Loki z


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.bengiamein.gq
Sending IP: 64.52.173.45
From: Ειδοποίηση αποστολής DHL <noreply@dhlexpress.com>
Subject: Οι αποστολές σας που αναφέρονται παρακάτω είναι προγραμματισμένες για παράδοση αύριο.
Attachment: DHL Receipt.pdf.z (contains "DHL Receipt.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a57e2dfc39ff15ffe1304c2e413dd9275a25b37d2d741a746655539f585fda78/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 12:30:07 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uv7c37bz74k77yjqjqxecpoze5nclm35fv2bu5dgkvjz6wc73j4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z a57e2dfc39ff15ffe1304c2e413dd9275a25b37d2d741a746655539f585fda78

(this sample)

Loki

Executable exe 3d1d3efe5443ac6fba2bda3cf531c5ac754b83dff0cc06258506aa9ab97e8d85

  
Dropping
MD5 efedc9d42940315609acbbb40ea04a1f
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3d1d3efe5443ac6fba2bda3cf531c5ac754b83dff0cc06258506aa9ab97e8d85

Comments