MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a92d20a2dd32c0fe6af346fc2938fc38ff25ee5886167e031375536dcdf67ecd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a92d20a2dd32c0fe6af346fc2938fc38ff25ee5886167e031375536dcdf67ecd
SHA3-384 hash: ac76d0392f7e5a0be8c1b242a195bdfa53b8ee13a78e5dda89af3361769fee3cce3d03e263b60c6924ebb4b3d1d7c48d
SHA1 hash: f337f4eb0e0f7803302948bd6d2a02faaa99ef03
MD5 hash: 335848d41a7c24ff74d9c065be0c004e
humanhash: sweet-winner-maine-spaghetti
File name:Invoice 21089020.gz
Download: download sample
Signature Loki
Create hunting rule
File size:400'830 bytes
First seen:2020-08-17 19:13:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:+7yfs9S8EBiE4MS8D2mMLt9+60oqEcmTbm5qJy2Mn3sZbC:+yfsjlfe2cmTb4GEnkC
TLSH 3A8423919E6AF4F78C2B95E77337543AE38A2445B352084EDE65B62EE69A418D3038C0
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.lbpl.in
Sending IP: 142.4.18.137
From: martina.teubl@wsa.co.at
Subject: Fwd: SOA/ Invoice 21089020
Attachment: Invoice 21089020.gz (contains "SC_0683756.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.GenericKD.43676699.3150.4339.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a92d20a2dd32c0fe6af346fc2938fc38ff25ee5886167e031375536dcdf67ecd/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 15:17:27 UTC
AV detection:
35 of 47 (74.47%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vewsbiw5glap42xti36csoh4hd7sl3syqylh4aytovjw3tpwp3gq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a92d20a2dd32c0fe6af346fc2938fc38ff25ee5886167e031375536dcdf67ecd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip a92d20a2dd32c0fe6af346fc2938fc38ff25ee5886167e031375536dcdf67ecd

(this sample)

Loki

Executable exe 14189dcf5cf7956f0a5c76bb32867cafdec8513df8d72469b53c1d2e723e2317

  
Dropping
MD5 31d419a6df09e1eb37b4ecea467bdf3c
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 14189dcf5cf7956f0a5c76bb32867cafdec8513df8d72469b53c1d2e723e2317

Comments