MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61dcd064a3d0a43e769b823c4e9ca13243ae2ea694e171ba724c40815003fe92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61dcd064a3d0a43e769b823c4e9ca13243ae2ea694e171ba724c40815003fe92
SHA3-384 hash: 45f835f0192a8f4e69cfdb162fe616c2f1f985502870822139aca0bcf1beca26b0197b54a70aac872b1cd6ab5691a9dc
SHA1 hash: 168588c8bc3fd37df73e1b1b7483439ac8dfb464
MD5 hash: 3f31955d8185482f580268c812b35894
humanhash: timing-batman-tennessee-saturn
File name:P.I O200214-0030-00011470942334_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:221'485 bytes
First seen:2020-07-06 07:02:50 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:QTplergohDwyHH5OYl0iHhKU2dfYB5UhwZhSEVpUCGnWo:ApQpFfnYg0AB5owZmCGWo
TLSH C124235090556998092FBAA1639FFDC13FA0DC20E4D59FAF4A2C98C694FC921DF7E0D0
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: hwsrv-740601.hostwindsdns.com
Sending IP: 104.168.165.92
From: Account Payable <zeco@slokltd.us>
Reply-To: Account Payable <pc.andnig.tvv@gmail.com>
Subject: RE:Revised Proforma Invoice
Attachment: P.I O200214-0030-00011470942334_pdf.gz (contains "P.I O200214-0030-00011470942334_pdf.exe")

Loki C2:
http://niskioglasi.rs/test2/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61dcd064a3d0a43e769b823c4e9ca13243ae2ea694e171ba724c40815003fe92/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 03:54:48 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mhonazfd2csd45u3qi6e5hfbgjb24lvgstqxdotsjraicuad72ja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 61dcd064a3d0a43e769b823c4e9ca13243ae2ea694e171ba724c40815003fe92

(this sample)

Loki

Executable exe d5a84390d3db1924d0f28a9c84bc5fab43b884800c26821606aed6f7b166b1b6

  
Dropping
MD5 1fffa2681f537ca3bfd0a16e06ab422c
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d5a84390d3db1924d0f28a9c84bc5fab43b884800c26821606aed6f7b166b1b6

Comments