MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17441ac0c284f1b39912712eea231ec56239684428a03eeb80e6654813c9eb61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 17441ac0c284f1b39912712eea231ec56239684428a03eeb80e6654813c9eb61
SHA3-384 hash: 2a776e438fe9a0d00cf51f988135647b9b9fe657be9fb68dce0b12d8d3209292c08db6b4069f70381ccd67079449f5f9
SHA1 hash: 0d5c17ba097ed0eca323484f080b0d831c609eb5
MD5 hash: e4f7f7614ec91cf200466112d1fe71d2
humanhash: mississippi-single-colorado-bulldog
File name:Reversed Contract 2020 pdf.ace
Download: download sample
Signature Loki
Create hunting rule
File size:541'066 bytes
First seen:2020-12-09 13:51:35 UTC
Last seen:2020-12-09 16:18:43 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 12288:xlYhH3CLSjdatdiewslZqDOrA8fBfBXbxwb+anfMHx:xCRpabiew2qgA8fFB9wbc
TLSH 19B423AECA8C75AA27EF45DFD39B7300C543ACE138D9981EF65529D1F325841BC19314
Reporter GovCERT_CH

Intelligence

File Origin
# of uploads :
2
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/17441ac0c284f1b39912712eea231ec56239684428a03eeb80e6654813c9eb61/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-12-09 13:52:08 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/17441ac0c284f1b39912712eea231ec56239684428a03eeb80e6654813c9eb61

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

ace 17441ac0c284f1b39912712eea231ec56239684428a03eeb80e6654813c9eb61

(this sample)

Loki

Executable exe ce6f3613198f224b2d264ba30dbd94bf2c6404f7299e6a09959f246d5e723a7a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ce6f3613198f224b2d264ba30dbd94bf2c6404f7299e6a09959f246d5e723a7a
  
Dropping
MD5 165f1e5ee211702d806ae4909e800a7d

Comments