MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5879679a6ae769c77520925f95256c9eb6ee0566ec6d343ca267a402695f0f86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5879679a6ae769c77520925f95256c9eb6ee0566ec6d343ca267a402695f0f86
SHA3-384 hash: 637215486ac026d2548d73c648b91e624ea9b2bdac20e6ac7793b97e1e6f1928271eb971dede022cdd03d36b76522d5b
SHA1 hash: c24d409b3a874f7d4dc1f219f36e642f3dadc9d6
MD5 hash: 8253ed85fccbb96b8d9d98accd3eac24
humanhash: zulu-ten-potato-tennis
File name:PO-4147074_pdf.ace
Download: download sample
Signature Loki
Create hunting rule
File size:493'522 bytes
First seen:2021-04-12 04:23:38 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 12288:tmvqop5yAxlAJFEu08JFVlNmibP7FVm5MeZn+O:+n5yslAJzF0CxVm5Jh+O
TLSH E5A42302E385FAEA504D6EEF09988438C05FB3E5B084A8D4C7A0334F6BF669DD5994DD
Reporter GovCERT_CH
Tags:Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5879679a6ae769c77520925f95256c9eb6ee0566ec6d343ca267a402695f0f86/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-04-12 04:24:05 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lb4wpgtk45u4o5jasjpzkjlmt23o4blg5rwtipfcm6sae2k7b6da._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5879679a6ae769c77520925f95256c9eb6ee0566ec6d343ca267a402695f0f86

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

ace 5879679a6ae769c77520925f95256c9eb6ee0566ec6d343ca267a402695f0f86

(this sample)

Loki

Executable exe 4380dd5341f62202eb5b410568bc722c065273402f128d17eeb1b6922d263cf5

  
Dropped by
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4380dd5341f62202eb5b410568bc722c065273402f128d17eeb1b6922d263cf5
  
Dropping
MD5 e24caaa7608fb1f4a08e0c002250ad34

Comments