MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b266a5d22ba104d9389aa5a8511619e697dbeb80bb4f012b07158072d231ccd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b266a5d22ba104d9389aa5a8511619e697dbeb80bb4f012b07158072d231ccd
SHA3-384 hash: ab2a16ee6e5d879a211290e3f2f574d4bfaf91d4ed968a4bd2eef7488d1c3ced04c39ad995c1410558bdcc424ea92e41
SHA1 hash: 80c84e461ae87d3686cc31e14377bc0cdfabf5ba
MD5 hash: 82757718a30d5f1bd028d022521cc456
humanhash: salami-maine-freddie-failed
File name:4D0E45FH.gz
Download: download sample
Signature Loki
Create hunting rule
File size:356'890 bytes
First seen:2020-07-20 09:34:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:J5zMwH3U/mt4rBaalAnHEy72y2BoEK+hDo5U7R6JRr3n9NV1GVfbIKW0SBta3NLi:Ju+t4XlAnki2B0586JRL9NmdMGSbad2
TLSH DC74237CE36B4F0DED24CA69363EAA331C7A935E18A4DBE74553CAA2DF164E88711050
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: se3s-lax1.servconfig.com
Sending IP: 23.235.223.129
From: Alainn Varela Gil (DHL ES) <Alain.VarelaGiil@dhl.com>
Subject: Re: DHL IMPORT FORM -VEA 6890 EURO << Reference ID: 63337 >>
Attachment: 4D0E45FH.gz (contains "4D0E45FH.exe")

Loki C2:
http://dsifoe.ml/sethr/logs/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6b266a5d22ba104d9389aa5a8511619e697dbeb80bb4f012b07158072d231ccd/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 09:36:07 UTC
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nmtguxjcxiie3e4jvjnikelbtzux3pvybo2paevqofmaoljddtgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/6b266a5d22ba104d9389aa5a8511619e697dbeb80bb4f012b07158072d231ccd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 6b266a5d22ba104d9389aa5a8511619e697dbeb80bb4f012b07158072d231ccd

(this sample)

Loki

Executable exe e95407fb0f4c97f4f1de70d796c4086b45b9019a261a1093d936008a65e1011f

  
Dropping
MD5 e288141c2eed1f677279609e2472427f
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e95407fb0f4c97f4f1de70d796c4086b45b9019a261a1093d936008a65e1011f

Comments