MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ebc3c316e749bcdb841838938d8d2ee0318a8227f82a7da88c4c59a7e5729cfd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ebc3c316e749bcdb841838938d8d2ee0318a8227f82a7da88c4c59a7e5729cfd
SHA3-384 hash: a07992759a6c4bfbcae0227e487f2ab60ad76ceff8462291d834568c1926240c209592ab780afeb6e58ef4d6c54b1995
SHA1 hash: 4a069f561a6af8a1cc41612e20ec72163a3bf0aa
MD5 hash: 7966e8469435a231e750fb2f76a5454a
humanhash: don-wolfram-bluebird-six
File name:EADVICE_012020_PDF.gz
Download: download sample
Signature Loki
Create hunting rule
File size:195'668 bytes
First seen:2020-07-02 06:35:09 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 3072:xqBn63upWl0FVAItZxF9hISUR44cDYQkuLgBI/wTmjiHtng4bboRDlvHzl9OiKYb:xqYRyVjrthzO5huMIITmjiJBEHTljR4y
TLSH 2714231E1DBAA6A47A750CB2E3547F5A32584CB6E063B9DCE05F9F501C9280CD81CDFA
Reporter abuse_ch
Tags:Citibank gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: cpanel3.centrin.net.id
Sending IP: 202.146.241.47
From: Citibank Indonesia <cs@sinokor.co.id>
Subject: Citibank Electronic Advice - IMTX1
Attachment: EADVICE_012020_PDF.gz (contains "EADVICE_012020_PDF.exe")

Loki C2:
http://mci-consultant.id/e/Panel/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ebc3c316e749bcdb841838938d8d2ee0318a8227f82a7da88c4c59a7e5729cfd/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 06:37:04 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5pb4gfxhjg6nxbayhcjy3djo4ayyvarh7avh3kemjrm2pzlstt6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz ebc3c316e749bcdb841838938d8d2ee0318a8227f82a7da88c4c59a7e5729cfd

(this sample)

Loki

Executable exe f352571786ff0addba546f558ee3725abd33dc51b186009f518ebf2f1ddf4f1c

  
Dropping
MD5 dc2a9fb47baf63793fba196e977462c7
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f352571786ff0addba546f558ee3725abd33dc51b186009f518ebf2f1ddf4f1c

Comments