MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c5dd9cdd25b44c39a48816ed800033de95b6fe0c488d475824ba10dda60a246. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c5dd9cdd25b44c39a48816ed800033de95b6fe0c488d475824ba10dda60a246
SHA3-384 hash: 31b538ae2c322edaa20bc25aa724b4d0adbb973d27cc54127e39c7fee1d336deda2030f78dec2876cbb7be526b654176
SHA1 hash: b464fdd6515758a0495539218496cb61175c6530
MD5 hash: e7ba0d52420cad0762892cf461321abf
humanhash: comet-tennessee-spaghetti-eight
File name:Inquiry.zip
Download: download sample
Signature Loki
Create hunting rule
File size:365'831 bytes
First seen:2020-07-06 08:15:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Z/LEc8jZ2dNf7EY2G0bwN9ZoGfgI3v2w93bXdX+A7PNI/iEDpPyEdmrJwNE95dOy:FEc8jAdNQY2g9ZoG4+vx3rdX+AzNM7An
TLSH 73742307452BE10AFEDDFA427DF91803CD9856E46C5239C6F1D050DA8FFC881982AF96
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: relay14.raiolanetworks.com
Sending IP: 217.182.121.197
From: giovannidesantis@agride.it
Reply-To: giovamidesantis@agride.it
Subject: Inquiry
Attachment: Inquiry.zip (contains "Dhbceds.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6c5dd9cdd25b44c39a48816ed800033de95b6fe0c488d475824ba10dda60a246/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 08:16:08 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nro5ttoslncmhgsiqfxnqaadhxuvw37ayseni5mcjoqq3wtaujda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 6c5dd9cdd25b44c39a48816ed800033de95b6fe0c488d475824ba10dda60a246

(this sample)

Loki

Executable exe f9a2f1e7311dab79c889621aeb6e11c48024343f8f44e787ab4903a8f2495554

  
Dropping
MD5 aed7063ecfeb47a9ffbd2df244d7cf3c
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f9a2f1e7311dab79c889621aeb6e11c48024343f8f44e787ab4903a8f2495554

Comments