MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 381ecf0b371339627cd10a29efd2e5b3979d4a42e2a1ccf840c83b310d41c041. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 381ecf0b371339627cd10a29efd2e5b3979d4a42e2a1ccf840c83b310d41c041
SHA3-384 hash: 31b465c9b978f2259e78e62f03d146cf3926e96e2f4f05250ed8ed7c66656e96ddcf790e1e520e0547195111155f51ca
SHA1 hash: 2eb9a4cd24ca88154fa7543e702370f3d95f5a5a
MD5 hash: bb6cf72d3509dd37e3101d5b3384bc31
humanhash: nitrogen-uncle-lake-freddie
File name:seaspan.gz
Download: download sample
Signature Loki
Create hunting rule
File size:402'828 bytes
First seen:2020-07-10 07:19:29 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:+kV5ZrmKkofkKilc0EusxuxlOmny+oqOnmz9yhe7ZR9zCHR9lt5fqh/:+kLmof5iaTYSmNoqSW1Qt9qh/
TLSH 548423EF2B92BE90F58D4601FD7D913F8941A062EB3FC0CCCF4619958D958F32A5A264
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server.fcmsgroup.com
Sending IP: 144.208.64.133
From: Seaspan Ship Management Ltd<rasingh@seaspanltd.ca>
Subject: Request for Updated vendor information
Attachment: seaspan.gz (contains "A148_57890.exe")

Loki C2:
http://amjaog.ml/sethr/logs/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.Delf.FareIt.Gen.7.17255.16370.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/381ecf0b371339627cd10a29efd2e5b3979d4a42e2a1ccf840c83b310d41c041/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-10 07:21:05 UTC
AV detection:
33 of 48 (68.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hapm6czxcm4we7grbiu67uxfwolz2ssc4kq4z6caza5tcdkbybaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 381ecf0b371339627cd10a29efd2e5b3979d4a42e2a1ccf840c83b310d41c041

(this sample)

Loki

Executable exe 3a147652dab4166c5bb4c35bb3bb74c3688ea072bce481237dfac38d31116f7e

  
Dropping
MD5 4260854d5c242d69107f49bad604b5c5
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3a147652dab4166c5bb4c35bb3bb74c3688ea072bce481237dfac38d31116f7e

Comments