MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1891748c2fd3821e15a519b10a34bb5372fd5601ad57fae537e4ed41ef593163. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1891748c2fd3821e15a519b10a34bb5372fd5601ad57fae537e4ed41ef593163
SHA3-384 hash: 082d0393ab81dbcbba0ef44c67a144992bb7c282c83875507fac97b11ecc8a0dc33abafac92a5c09e23c272fda65a472
SHA1 hash: 27a736b8941e90ac1225555a01f2407e11d080d2
MD5 hash: 3dc268c59c75496f9798d49a981046d7
humanhash: bakerloo-solar-eleven-nine
File name:FOC invoices_pdf.exe
Download: download sample
Signature Loki
Create hunting rule
File size:114'688 bytes
First seen:2020-03-18 07:47:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a3c07dcbf733ef51b1d41e81d2f638c2 (1 x Loki)
ssdeep 1536:+QWXwIPVZFDGPomZmBAeQdR+I24X+15HioVOaq4V+y7e:+S6rD3H5N1kAOz4X7e
Threatray 613 similar samples on MalwareBazaar
TLSH D5B36C42FB90D43BD119863EAC46D2920916FC5469E2D64B3AD87B2E79F40F2CF2DB11
Reporter jarumlus
Tags:Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Vebzenpak-7639837-0
Create hunting rule

Win.Trojan.Agensla-7639840-0
Create hunting rule

Win.Malware.Vebzenpak-7639843-0
Create hunting rule

Win.Dropper.Fareitvb-7639864-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-03-18 03:45:00 UTC
AV detection:
25 of 30 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dcixjdbp2obb4fnfdgyqunf3knzp2vqbvvl7vzjx4twud32zgfrq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
25fdf9f56f06a54483b8280c76f2402526f29394e367af1a8c99cd80801a9527
Loki
50ca73e510646ea1534f248099ce844f7f6178adb93055f8459ec07645f48e79
Loki
5c86fcf32d1f15a745dd2f39989630ac310d1aee52af7b5f762f75f8855879ab
Loki
70d577aba943b783ec606abcfa912bf97c9fd4f22d5e46ff1d718d350a8e4fcc
Loki
85a143f34f286cd9c586a4b7abe97fe012b529f90a940852cbfadc6c9494c4b3
Loki
89210ae907c9573298a900f88b97082c190618d64ecfa37eb5afda4615629475
Loki
b4c98180c88d1c3aeea6d37b0642d5fa3a9d282b417615a7f3c8cda80389ae64
Loki
e8d41df74484529065bad33443225cf40b05423b7cd4b0af478043c13394750e
Loki
ef2ea78c09850bffba6cb63a39e2119115573611d695dd53d3d01256a07f2595
Loki
f1ba59863abc7d03f67577aa4b75ab121608c76433981f394651f2b327914e9c
Loki
+ 603 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1891748c2fd3821e15a519b10a34bb5372fd5601ad57fae537e4ed41ef593163

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::EVENT_SINK_AddRef

Comments