MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50c8be9b19f4787f9f6d56255e8aa937b1e0eebbef84ef76fc4ec36db80fbe6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 50c8be9b19f4787f9f6d56255e8aa937b1e0eebbef84ef76fc4ec36db80fbe6c
SHA3-384 hash: 7602ac6342e5b2327f84799c408f59aa222724caffe1e9839c1a5279a25869e66268e95b631deb97c7ccc2c669e7b56c
SHA1 hash: 352f6bf0dd48f9d28a9981ec011cf0e9ca2c43a2
MD5 hash: f74b7de6cd8d6112cd68899ef10ea2ec
humanhash: grey-snake-winner-lima
File name:New Quotation for 22.img
Download: download sample
Signature Loki
Create hunting rule
File size:452'608 bytes
First seen:2022-01-31 09:26:03 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:iF7fezqzPnxeDfUlJ2vZ91Hx+LD+XGd3Jz2jDooVum:iF7fyqzPnxeDiwvZ91MX+XSZ64o8m
TLSH T15BA4BB1CB6C166E2FD1D93F049050A24AB162B37B640ABB233CA95CEB74F7AF1D45D84
Reporter cocaman
Tags:img Loki


Avatar
cocaman
Malicious email (T1566.001)
From: "FREDA BARNOR <freda.barnor@promasidor.com>" (likely spoofed)
Received: "from server.listerhospital.com.gh (server.listerhospital.com.gh [162.214.92.230]) "
Date: "31 Jan 2022 08:23:42 +0100"
Subject: "REQUEST FOR QUOTQTION 2022 PLACEMENT. (TREAT AS URGENT)"
Attachment: "New Quotation for 22.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
207
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.38825591.22090.15751.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm cmd.exe control.exe fareit obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/61f7ab68d7fd65ae55fbbc6b/reports/ef0e76b2-ac5f-4302-96ae-235f4f7f8344/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/50c8be9b19f4787f9f6d56255e8aa937b1e0eebbef84ef76fc4ec36db80fbe6c/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2022-01-31 09:27:09 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
11 of 28 (39.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kdel5gyz6r4h7h3nkysv5cvjg6y6b3v356co65x4j3bw3oapxzwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/50c8be9b19f4787f9f6d56255e8aa937b1e0eebbef84ef76fc4ec36db80fbe6c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

img 50c8be9b19f4787f9f6d56255e8aa937b1e0eebbef84ef76fc4ec36db80fbe6c

(this sample)

Loki

Executable exe c206dea522616bcc623ba4ce9913dd0cbc56d9c48e37f15e133ef28680b12497

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c206dea522616bcc623ba4ce9913dd0cbc56d9c48e37f15e133ef28680b12497
  
Dropping
Loki

Comments