MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55fcfb9488c770cb3be31a37ce4745806abd760fb9ad62464fb841030f3ce13e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 55fcfb9488c770cb3be31a37ce4745806abd760fb9ad62464fb841030f3ce13e
SHA3-384 hash: 409d024a17dbcc76a3468eba8bcfa7f2822608994ef8f055e9dafdf7fbc1fb73de50200c56ec6c04619acc77d0ee9a6f
SHA1 hash: 82c84312f4fcd7ab250f307261f1de911057d46d
MD5 hash: a9cd4dd80f6f3ca2e9717fe5a11d1237
humanhash: delta-river-north-happy
File name:Order list 28-03-21.cab
Download: download sample
Signature Loki
Create hunting rule
File size:663'064 bytes
First seen:2021-03-29 09:48:09 UTC
Last seen:2021-03-29 12:38:49 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:0sOKEbAY0nluh0T5ZcxSO8Al/RbV5pg+s9GUsWx7YVUNsx:xFE30nlu+T5+fHRJODsBVUNm
TLSH 7EE48E62B7804C37D06719749C1B4AE5EC35FF103D28A89B6BE86E0C5FB835179392A7
Reporter cocaman
Tags:cab Loki


Avatar
cocaman
Malicious email (T1566.001)
From: "=?UTF-8?B?U3VtaW7igIsgS2lt?= <exports@bomindustry.biz>" (likely spoofed)
Received: "from postfix-inbound-8.inbound.mailchannels.net (inbound-egress-6.mailchannels.net [199.10.31.238]) "
Date: "29 Mar 2021 09:23:36 +0000"
Subject: "purchase order"
Attachment: "Order list 28-03-21.cab"

Intelligence

File Origin
# of uploads :
3
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/55fcfb9488c770cb3be31a37ce4745806abd760fb9ad62464fb841030f3ce13e/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-29 07:59:06 UTC
File Type:
Binary (Archive)
Extracted files:
71
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kx6pxfeiy5ymwo7ddi344r2fqbvl25qpxgwwerspxbaqgdz44e7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/55fcfb9488c770cb3be31a37ce4745806abd760fb9ad62464fb841030f3ce13e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 55fcfb9488c770cb3be31a37ce4745806abd760fb9ad62464fb841030f3ce13e

(this sample)

Loki

Executable exe 05fde892732b9dc4d7e78ef54fd7d2ab28caa582afab008a4556909b47c831e3

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 05fde892732b9dc4d7e78ef54fd7d2ab28caa582afab008a4556909b47c831e3
  
Dropping
Loki

Comments