MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e971701553082cced88a2882308d53b698fa6198cb37bf7d58b11271bf91edd3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e971701553082cced88a2882308d53b698fa6198cb37bf7d58b11271bf91edd3
SHA3-384 hash: 9ba9870c909150b881f6e546b1d63b37d72f18c98c1d3792ccc7a08bc07471f44ca48e6b8a474ed4681f23404e0da9d7
SHA1 hash: 5169c0a2e481e0d1b4fc9b831d21c9b4c6ce576f
MD5 hash: 071938b7e4374cde88b5ab37e45cd251
humanhash: fillet-nuts-orange-nevada
File name:DOC-SCAN03313PI_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:445'028 bytes
First seen:2020-05-13 06:49:52 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:ZcGoHekbBijnYDhDISmvtfU3HnDfnYpafF/UcEirVZSI:CGsVijnAlEFM3HbvfFccEirVz
TLSH CE9423C965D420C0F736B7365CD2CC16E27E6A1A926B32417A3C33B14D3A2DF96D8B64
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: 125-web12.theserversystem.net
Sending IP: 67.222.145.125
From: Worldwide Logistics Shanghai Co <sha.lineus@worldwide-logistics.cn>
Subject: RE: New PI 2020
Attachment: DOC-SCAN03313PI_pdf.gz (contains "DOC-SCAN03313PI_pdf.exe")

Loki C2:
http://broken8.cf/L5/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.W32.Trojan3.APDS.16897.29180.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 10:12:56 UTC
File Type:
Binary (Archive)
Extracted files:
294
AV detection:
29 of 48 (60.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5fyxafktbawm5wekfcbdbdktw2mpuymyzm3367kywejhdp4r5xjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip e971701553082cced88a2882308d53b698fa6198cb37bf7d58b11271bf91edd3

(this sample)

Loki

Executable exe 7c07dedbbf3975e536346ab9ea0e6ca8dc0988c3a44b39b62005c8633ef4ac02

  
Dropping
MD5 c337c8aa03504b8a5ceb2e8d645bd03e
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7c07dedbbf3975e536346ab9ea0e6ca8dc0988c3a44b39b62005c8633ef4ac02

Comments