MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b91d45789f050e69222c042a03e8357e4e99770ef27a9df6b004ce99901a1bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0b91d45789f050e69222c042a03e8357e4e99770ef27a9df6b004ce99901a1bc
SHA3-384 hash: 2b0a9543666c5f961aff2d15f3671cbcffebefbf2161258c34dd6359c558f09ed858683a36d0465ca1f3844dc7ac7156
SHA1 hash: d26834875c6842c023b850c4b456178ac5fac256
MD5 hash: 25bd37e50f5dd72a8583a1f298080a1a
humanhash: summer-leopard-glucose-football
File name:Letter of demand. Unpaid invoice.pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:139'702 bytes
First seen:2020-06-15 12:13:43 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 3072:1dUA6ah4oueP+ywIY4F/22kFydBDq/wFUBFyTQ10Zrugqte:1dKQRu/MY4F/zhB+/wFUWTMEAe
TLSH 81D322506B3625C055D8C1AA917CC289D2B76B6D587E3C8C0CBA1FCBDED4F50A705CA7
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: slot0.clevelandcascades.com
Sending IP: 45.95.169.236
From: legal@wjvrlaw.co.za
Subject: Letter of demand. (Unpaid invoice)
Attachment: Letter of demand. Unpaid invoice.pdf.gz (contains "Letter of demand. Unpaid invoice.pdf.exe")

Loki C2:
http://auongo.com/~zadmin/lk/dn/gate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.SoftPulse.dh.19018.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 12:15:08 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=boi5iv4j6bionercybbkapudk7sotf3q54t2tx3labgotgibug6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 0b91d45789f050e69222c042a03e8357e4e99770ef27a9df6b004ce99901a1bc

(this sample)

Loki

Executable exe 971609985552df81174bf8e23ca9fd7b6feff1f8e86ee5e28b535d955e3358bd

  
Dropping
MD5 6ae8f2486b818ed699c3cea51ae87e0e
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 971609985552df81174bf8e23ca9fd7b6feff1f8e86ee5e28b535d955e3358bd

Comments