MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9598cc20d8bf478d2e825693c03ba57ee2d46e82238d726947403d8f60bb4552. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9598cc20d8bf478d2e825693c03ba57ee2d46e82238d726947403d8f60bb4552
SHA3-384 hash: c6741d440dbc2184e8972ca510e16777247fa65ac1bc7610e84cadc8917e25589a9f2bd666a9cffa9abe32da22b56cd2
SHA1 hash: 933c516bd467703f28a8f9a7ebb9f55c006f376f
MD5 hash: 13f493107ecbbaa9a4c65b6a326baf0a
humanhash: four-floor-kansas-lima
File name:Purchase Order RFQ-HL51L07.ace
Download: download sample
Signature Loki
Create hunting rule
File size:726'298 bytes
First seen:2021-02-12 22:12:39 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 12288:BpJAcQbNW0AiZz5xBQpr7VL7M23/k5UyDhtWIPjF5w5EW334f9aQwIXHKahGDGIY:mcQbNWQx5xKFZk5b+n5ESof7wIXs63OE
TLSH 52F4331C16D985F8EA7C2B422FA81633EDBAC6999E761C52FFC4302C3D44765037998B
Reporter GovCERT_CH

Intelligence

File Origin
# of uploads :
1
# of downloads :
295
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9598cc20d8bf478d2e825693c03ba57ee2d46e82238d726947403d8f60bb4552/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-01-22 16:39:32 UTC
AV detection:
18 of 44 (40.91%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9598cc20d8bf478d2e825693c03ba57ee2d46e82238d726947403d8f60bb4552

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

ace 9598cc20d8bf478d2e825693c03ba57ee2d46e82238d726947403d8f60bb4552

(this sample)

Loki

Executable exe e24432776021ce6abef3df321e67fdfa684e2a2b2b61ee417e406b6feab92087

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e24432776021ce6abef3df321e67fdfa684e2a2b2b61ee417e406b6feab92087
  
Dropping
MD5 b2acecde3b67c8eeab8f5ff1316cbbd0

Comments