MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56a2201ab88a75fa2f1b9616a81ac1d08c06562040fe5b5bdb1f6c98fdb45261. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56a2201ab88a75fa2f1b9616a81ac1d08c06562040fe5b5bdb1f6c98fdb45261
SHA3-384 hash: a942b71208e5f1ee81491652ef26ad73c9c6f97acdc984186f6548edef007649c604e07a8ae5fadc4cc27a86f5d39490
SHA1 hash: e3f323f43a5fe7a307d6df344331535841a3ddf8
MD5 hash: 2104a83fd5720db97b084e009aee86ae
humanhash: kitten-blossom-fanta-florida
File name:GF ISF Required Elements Worksheet v2 0.zip
Download: download sample
Signature Loki
Create hunting rule
File size:716'920 bytes
First seen:2020-07-29 11:16:06 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:C5AaLH8KP3prcDKKSF2c6slBJF5AaLH8KP3prcDKKSF2c6slBJ0:Cr5P3pydSFvlBJFr5P3pydSFvlBJ0
TLSH ACE4232E347527AC9AA67927860E7BDBA195892093FC42F0594D52F32F77071CFBB081
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.mojoka.tk
Sending IP: 45.147.162.151
From: Teresa Kao <Teresa.Kao@expeditors.com> <admin@mojoka.tk>
Subject: Fwd: SO - X012/6810764733 - 核對單 - Top Urgent
Attachment: GF ISF Required Elements Worksheet v2 0.zip (contains "GF ISF Required Elements Worksheet v2 0.scr")

Loki C2:
http://profortune-tw.com/cloks/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Stealer.19347.10936.15784.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/56a2201ab88a75fa2f1b9616a81ac1d08c06562040fe5b5bdb1f6c98fdb45261/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 11:18:07 UTC
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k2rcagvyrj27uly3sylkqgwb2cgamvraid7fww63d5wjr7nukjqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/56a2201ab88a75fa2f1b9616a81ac1d08c06562040fe5b5bdb1f6c98fdb45261

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 56a2201ab88a75fa2f1b9616a81ac1d08c06562040fe5b5bdb1f6c98fdb45261

(this sample)

Loki

Executable exe 2e7625fe59037dd24812f6790a4d7bc27acae2463d07161cebe3b0360f77dc96

  
Dropping
MD5 8c4ace52e5939a4d3365bdbe55bf3a7a
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2e7625fe59037dd24812f6790a4d7bc27acae2463d07161cebe3b0360f77dc96

Comments