MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 731c30ec1ce9a6b985dadac72e1877f351732abc61c20948ac4e4a0a51c8a8b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 731c30ec1ce9a6b985dadac72e1877f351732abc61c20948ac4e4a0a51c8a8b1
SHA3-384 hash: 4c2a0bd70c180dcad360f28d3e033adcb1ab819f512c3e66da4d364c3c222910c6c0ebc074c9eb7a7f44e6f52b9be8b1
SHA1 hash: 43c21fcdc4cac6a4abfb397cd778c9918f3ec878
MD5 hash: ad6c7888e33e6b34d72d1ee5d2ff6aa2
humanhash: happy-virginia-green-carpet
File name:Chake Berberian Order_pdf.zip
Download: download sample
Signature Loki
Create hunting rule
File size:277'552 bytes
First seen:2020-11-04 15:28:53 UTC
Last seen:2020-11-05 20:12:41 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:sPH54jhHUc6Mu+d6dFSXvmxsQUnoMGqXIrAo5ogsGy:iZ6vu+d6Px0njBXIrAoGf
TLSH 074423873ED786C11F325DAC7B3B575416249DAB7C06CDD412A3C7A4AAE8CC24AB3634
Reporter cocaman
Tags:Loki zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Chake Berberian<jj@avientek.com>"
Received: "from avientek.com (unknown [185.125.204.39]) "
Date: "03 Nov 2020 18:45:04 -0800"
Subject: "Chake Berberian Order"
Attachment: "Chake Berberian Order_pdf.zip"

Intelligence

File Origin
# of uploads :
3
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/731c30ec1ce9a6b985dadac72e1877f351732abc61c20948ac4e4a0a51c8a8b1/
Threat name:
ByteCode-MSIL.Infostealer.Tepfer
Create hunting rule
Status:
Malicious
First seen:
2020-11-04 05:00:14 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=omodb3a45gtltbo23lds4gdx6nixgkv4mhbassfmjzfauuoivcyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/731c30ec1ce9a6b985dadac72e1877f351732abc61c20948ac4e4a0a51c8a8b1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 731c30ec1ce9a6b985dadac72e1877f351732abc61c20948ac4e4a0a51c8a8b1

(this sample)

Loki

Executable exe da9d5824f98c31b4884a41111309055a5a33b4b1ec2d42bf223cfac782a604dc

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 da9d5824f98c31b4884a41111309055a5a33b4b1ec2d42bf223cfac782a604dc

Comments