MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6262a7bdf5291a08af69e846a78e9deca16a7478cf797feefaf9aa3c4d6491d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6262a7bdf5291a08af69e846a78e9deca16a7478cf797feefaf9aa3c4d6491d5
SHA3-384 hash: 6f78628b99a17985a085c7da4fbb2f635b961d022e3810ab629409f52453519594754b0ff7737997e81a71ba3f303ce2
SHA1 hash: a688cea5d997268c9cd209c3511e36d7db9e2dfd
MD5 hash: 2ae0ec43a66d1f583645bdba5e2011e0
humanhash: steak-december-timing-wisconsin
File name:cenu piedāvājums 21-07-2020·pdf.exe
Download: download sample
Signature Loki
Create hunting rule
File size:390'701 bytes
First seen:2020-07-21 12:16:04 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:13pukd9YZnAOOxKmL+LlSNAuAGmVE1vI3Z+uM6IjvtnKJz6R6yQ+wwfRPirD0C:F1YZnAZMLHZxCvAJz6wyP43N
TLSH 718423F5A17B23B94B59007A53D30544729A81E29B794F72D70F9FA0F38043BAC78EA5
Reporter abuse_ch
Tags:exe geo Loki LVA


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server2.e-volution.gr
Sending IP: 37.48.90.91
From: Latvijas Universitāte <Admin@lu.lv>
Subject: cenu piedāvājums (Latvijas Universitāte) EUI894/LV4600
Attachment: cenu piedāvājums 21-07-2020·pdf.exe (contains "cenu piedāvājums 21-07-2020·pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6262a7bdf5291a08af69e846a78e9deca16a7478cf797feefaf9aa3c4d6491d5/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 12:17:04 UTC
AV detection:
34 of 48 (70.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mjrkpppvfenarl3j5bdkpdu55sqwu5dyz54x73x27gvdytleshkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legal
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6262a7bdf5291a08af69e846a78e9deca16a7478cf797feefaf9aa3c4d6491d5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 6262a7bdf5291a08af69e846a78e9deca16a7478cf797feefaf9aa3c4d6491d5

(this sample)

Loki

Executable exe f245c74083a4bb0b21e76aeaa58e48b66f448c4c469067d997eb810e6d2f6fc8

  
Dropping
MD5 de21a6a7a20418c905ad5c794ed6761e
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f245c74083a4bb0b21e76aeaa58e48b66f448c4c469067d997eb810e6d2f6fc8

Comments