MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98c8e17ddcf9d9ad39b9279149a2fa4de9146a0a5720b29ef77a3a4fd471e2d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98c8e17ddcf9d9ad39b9279149a2fa4de9146a0a5720b29ef77a3a4fd471e2d1
SHA3-384 hash: afadb24a399545ae593b321d8f383e7898f5e941c420c24c491421d8995ee1f340b3cafe45269b3c8beef749b81aa833
SHA1 hash: 14e4758ae158c64aeaa082d4a2ccd998094e8f97
MD5 hash: 08a1937d56b37072627d2bf8644492ae
humanhash: nitrogen-jig-single-jupiter
File name:TQ-06383.gz
Download: download sample
Signature Loki
Create hunting rule
File size:402'973 bytes
First seen:2020-11-19 07:31:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:pxC2qmWobguZWdG5c9J/VL8CfXiXNzaUP0ykkN4:xbFguZf+9HICqXNPhB+
TLSH 668423B6313D4B262E49ADA8501B6F431C54783C2FD0A24923B4D9D12BCF7425FB6D9B
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server3.elighthost.com
Sending IP: 173.249.38.250
From: Charlesworth, Ivan <ivan@positivedesign.com.sg>
Subject: INVOICE & STATEMENT FOR OCTOBER
Attachment: TQ-06383.gz (contains "TQ-06383.exe")

Loki C2:
http://lmpulsefashion.net/bryt/bryt3/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/98c8e17ddcf9d9ad39b9279149a2fa4de9146a0a5720b29ef77a3a4fd471e2d1/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-11-19 07:32:05 UTC
AV detection:
30 of 47 (63.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tdeoc7o47hm22onze6iutix2jxuri2qkk4qlfhxxpi5e7vdr4liq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 98c8e17ddcf9d9ad39b9279149a2fa4de9146a0a5720b29ef77a3a4fd471e2d1

(this sample)

Loki

Executable exe 1125ffd226972025061ad329ba6319fd73e0412e850e68a72ad9111f7bd3a3d6

  
Dropping
MD5 aa7d5ad5fe794475a1e1d7916ba3a374
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1125ffd226972025061ad329ba6319fd73e0412e850e68a72ad9111f7bd3a3d6

Comments