MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f89c1b1de363ffae9ae45bb4b0be8125e294cf9c58ecf3d289288c57f3aeb64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f89c1b1de363ffae9ae45bb4b0be8125e294cf9c58ecf3d289288c57f3aeb64
SHA3-384 hash: 1ce06bf72a6f4c245b9d8a37a8796fa71df84f3f521136b0ddf778689539b098bc7898de3625cd8a15df7bf2d0d8b203
SHA1 hash: 227208de61929e27dd251011ab0addb58fb79e3a
MD5 hash: a994f5756f7567be18393acb337c7ce9
humanhash: minnesota-alaska-lithium-eleven
File name:437E Invoice and Packing list.rar
Download: download sample
Signature Loki
Create hunting rule
File size:329'390 bytes
First seen:2020-08-18 12:13:25 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:AFr7DUWj6pGc5r/ZA6rU9iQJbqyQ7dHyIFH6YIS7JmP3u6A1mqXQ0nU4ZEz:A8pL56o6+B1FH17JR6Y3qt
TLSH AC6423AB58FDD33C3F1F30272A428B45226249DC9567312C6F1996776A2324EF232DE1
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: garen.com
Sending IP: 117.121.213.248
From: Ermin Yudi <info@maldivescargo.net>
Subject: Pending Payment Update 18-08-20
Attachment: 437E Invoice and Packing list.rar (contains "437E Invoice and Packing list.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5f89c1b1de363ffae9ae45bb4b0be8125e294cf9c58ecf3d289288c57f3aeb64/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 12:15:07 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l6e4dmo6gy77v2noiw5uwc7icjpcsthzywhm6pjiskemk7z25nsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5f89c1b1de363ffae9ae45bb4b0be8125e294cf9c58ecf3d289288c57f3aeb64

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 5f89c1b1de363ffae9ae45bb4b0be8125e294cf9c58ecf3d289288c57f3aeb64

(this sample)

Loki

Executable exe b4ac52ae5b0abc63806e558ec45f7a93182ff33684c2a0341339ba7573fc91bf

  
Dropping
MD5 10541e53a7476c8f32611cfa56d4686c
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b4ac52ae5b0abc63806e558ec45f7a93182ff33684c2a0341339ba7573fc91bf

Comments