MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50e499e7f654d00ba6a4ff193447e9b86f1a5e14c4adcf7e7b35eaf6b2a680f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 50e499e7f654d00ba6a4ff193447e9b86f1a5e14c4adcf7e7b35eaf6b2a680f8
SHA3-384 hash: 9be7a5bb65e879c595c86455d9e30f2670a0347a01a0ee091be89a43363821e2e81c0fd9c1c74d3e8c4c5be9fed36c30
SHA1 hash: 8e4948f86fa38565d78dc1b91d9c93bb037084e1
MD5 hash: 1ef45950d17c421449d88eb15ebe904f
humanhash: princess-single-uniform-emma
File name:UIF COVID-19 June 2020 Payment Approval.pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:170'132 bytes
First seen:2020-06-12 06:48:48 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 3072:w+wHvcS5hLXMaNqEc/uYFn3D0k0ILNsJiHG/PNzvmLD11B3E8scxqd8REqGV:HakSfLXM1/uknT0PILbkPFmL/6dd82J
TLSH 97F322FF697FC619AE4E265000A2B857196FDCAADB9D2F44D864C114B2ACB7C0C13257
Reporter abuse_ch
Tags:COVID-19 gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: host.sasavomarketing.com
Sending IP: 199.217.117.135
From: uifcovid19@labour.gov.za
Subject: UIF COVID-19: June 2020 Payment Approval
Attachment: UIF COVID-19 June 2020 Payment Approval.pdf.gz (contains "UIF COVID-19 June 2020 Payment Approval.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 06:50:09 UTC
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kdsjtz7wktiaxjve74mtir7jxbxruxquysw467t3gxvpnmvgqd4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 50e499e7f654d00ba6a4ff193447e9b86f1a5e14c4adcf7e7b35eaf6b2a680f8

(this sample)

Loki

Executable exe 1c74555d678d882172bf34e68e7058aa8d11acf3f951c87801cafde0801294c3

  
Dropping
MD5 aaa2124e2018082301c6f470361792f1
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1c74555d678d882172bf34e68e7058aa8d11acf3f951c87801cafde0801294c3

Comments