MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8762cc7bdda5b64ed2e9b5e1dc4c5e3be2da9207ffa595e7f1cd0434650ed5a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8762cc7bdda5b64ed2e9b5e1dc4c5e3be2da9207ffa595e7f1cd0434650ed5a7
SHA3-384 hash: 00e1107e959562c12cced77558cfb8eec6452657bf06e5a32158edf73dcbb757a46502b4289bd6e063412efef096614b
SHA1 hash: ab42f851e331e8bdc1deaebde17a7776262bf559
MD5 hash: 3b0914a33ca6d5c5081fa13e62a70a47
humanhash: spring-nevada-maryland-beryllium
File name:INVOICE_HQ2201800000532_HQ2201800000613_PAST_DUE_pdf.zip
Download: download sample
Signature Loki
Create hunting rule
File size:358'503 bytes
First seen:2020-07-29 07:51:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:UU1P57fHWV9AcnmMgiNgk5FQq7qi77E2L7sSSsjbeZ4R3GIjjlPxdueo8PIkSZ:UUZ5Si6FgnAqc7PTBSkSZ
TLSH E474232F88289DF72F46D1CC3610DB2D6A5EEF2EAE41C42996FEA5E12CC51489CF51C4
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: pkz37-4-spamexpert2.hoster.kz
Sending IP: 185.113.132.23
From: zpk_nii@rniiot.kz
Subject: *Overdue* payment follow up-3rd Reminder- PO HQ2201800000512
Attachment: INVOICE_HQ2201800000532_HQ2201800000613_PAST_DUE_pdf.zip (contains "INVOICE_HQ2201800000532_HQ2201800000613_PAST_DUE_pdf.exe")

Loki C2:
http://sieqwarteg.com/chief/chief2/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Stealer.19347.10936.15784.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8762cc7bdda5b64ed2e9b5e1dc4c5e3be2da9207ffa595e7f1cd0434650ed5a7/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 04:11:33 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q5rmy665uw3e5uxjwxq5ytc6hprnveqh76szlz7rzucdizio2wtq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/8762cc7bdda5b64ed2e9b5e1dc4c5e3be2da9207ffa595e7f1cd0434650ed5a7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 8762cc7bdda5b64ed2e9b5e1dc4c5e3be2da9207ffa595e7f1cd0434650ed5a7

(this sample)

Loki

Executable exe 400dfcda6e4685431b499a17f7ec57949472b72e06f7f5e7cafad066e20315dc

  
Dropping
MD5 46443b771ef4c352c2d0e7c4af973eca
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 400dfcda6e4685431b499a17f7ec57949472b72e06f7f5e7cafad066e20315dc

Comments