MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9acad394892b94fcc7ce490a3fd5279c1c5d935b95470e150afaf15dc3f1b49d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9acad394892b94fcc7ce490a3fd5279c1c5d935b95470e150afaf15dc3f1b49d
SHA3-384 hash: e06665be326647ba8c8aca29db9f63850cd65badc2686f825d5ee9d85b984173c6b8061cb87920b72beb2e6238be0cd6
SHA1 hash: 6a1dd3cd6ec98463d01623a9dd2b00b39a8497f3
MD5 hash: 712a168dae1cafaa4645979784b613ba
humanhash: texas-bulldog-equal-five
File name:LEGROUP RFQ LG1 26061403 -BHXH-QLT.rar
Download: download sample
Signature Loki
Create hunting rule
File size:246'590 bytes
First seen:2020-06-26 06:30:00 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:4E5aem5LFkv3FwZgtWH59AAP7JvFA5xTKQA6HLW66sf4MkmRmL:4cELysdDP7JtBF6HLh6y4MBR4
TLSH 7E34239E5904C2FB8695EDA60F2000B0BD5CC9B8446CEB521EC33779908997DF9DD5E4
Reporter abuse_ch
Tags:geo Loki rar VNM


Avatar
abuse_ch
Malspam distributing Loki:

HELO: pro34.emailserver.vn
Sending IP: 103.15.48.89
From: Nguyễn Thụy Hồng Phượng | LeGroup VN [sales.hanoi@legroup.com.vn] <thlin@vitinhmainguyen.com>
Subject: RE: LeGroup VN - Fixed Order for Part LG1: 26061403 HANOI FACTORY
Attachment: LEGROUP RFQ LG1 26061403 -BHXH-QLT.rar (contains "TRIUMPH RFQ #713-670-2006-BHXH-QLT.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9acad394892b94fcc7ce490a3fd5279c1c5d935b95470e150afaf15dc3f1b49d/
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-26 06:31:04 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tlfnhfejfokpzr6ojefd7vjhtqof3e23svdq4fik7lyv3q7rwsoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 9acad394892b94fcc7ce490a3fd5279c1c5d935b95470e150afaf15dc3f1b49d

(this sample)

Loki

Executable exe 8287f37fbd5697059ed98cd9b6b925c832fe6b229c035354e588e8a8793f9590

  
Dropping
MD5 1baf63ee3fcc3cd580594c21218291cc
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8287f37fbd5697059ed98cd9b6b925c832fe6b229c035354e588e8a8793f9590

Comments