MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed1830477fd03b13a9f41c660e106c23d9f278cf05c30a81d27a4068dfda4121. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed1830477fd03b13a9f41c660e106c23d9f278cf05c30a81d27a4068dfda4121
SHA3-384 hash: 2863fe817de5b8841367486f6d6dcb1fa959278ff79368f69b0a315f9526664dc048e6b9f44143287e92b55f29b02c3f
SHA1 hash: f5e3a89f6673ad744fe77526ba050f4a5ff9de9b
MD5 hash: 0d4d4e43864edf60d2b64e4cf1389323
humanhash: angel-lamp-speaker-uncle
File name:MOH Contact Form 29-06-2020·pdf.zip
Download: download sample
Signature Loki
Create hunting rule
File size:350'186 bytes
First seen:2020-06-29 06:16:52 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:N2Pc3mZxVD6oITqYJemX4JmEHHaiVa2OC0MvHhhmUEIec/ES2:c02TTbYJo3aiVV0AhIUEIH/R2
TLSH 8A74237E1188937076A27F678209B848AFF0147B3C43FA36897582C8A6557C8F7DD5B2
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.genoxy.tk
Sending IP: 103.109.37.216
From: Joan KANG (MOH) <Joan_KANG@moh.gov.sg>
Subject: URGENT: Request for Information
Attachment: MOH Contact Form 29-06-2020·pdf.zip (contains "MOH Contact Form 29-06-2020·pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Fareit-6863179-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.27245.ZipHeur.HideExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ed1830477fd03b13a9f41c660e106c23d9f278cf05c30a81d27a4068dfda4121/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 06:18:09 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5umdar372a5rhkpudrta4edmepm7e6gpaxbqvaospjagrx62ieqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip ed1830477fd03b13a9f41c660e106c23d9f278cf05c30a81d27a4068dfda4121

(this sample)

Loki

Executable exe 58a6fca310a48132ae925f7689fc505c0911f2edad92a2ffc164068c796e9e4f

  
Dropping
MD5 cd999f4c46e6c0d7948b47ec71348c9c
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 58a6fca310a48132ae925f7689fc505c0911f2edad92a2ffc164068c796e9e4f

Comments