MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2581a526dcf63422c4a4b5e900040d14ed72378305d678508d8b6449a3900e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b2581a526dcf63422c4a4b5e900040d14ed72378305d678508d8b6449a3900e4
SHA3-384 hash: ee146bbd578ec358a92f61479c29051df2bb234c6be4017761f0a1c77ad288db8241c2ee811eb627e05964cdffacc5eb
SHA1 hash: d11dc8badb8b87d5de7feae90009bd104aa6c689
MD5 hash: 81583553ff4dca623514af92ddd70cdc
humanhash: carolina-king-fourteen-ink
File name:informe bancario.img
Download: download sample
Signature Loki
Create hunting rule
File size:1'245'184 bytes
First seen:2020-12-30 09:14:57 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:UAno2iNgld+QnjNG4x+wsJ7ONzeoaOGftab0phOqlNPMD41/R:U6o1w+QnZn1NzG3f6SNPx1/R
TLSH B2456A03E5AEF92CD018527BA711B11137A198D12D82C17D7BC9A7EA19F11CAC63C7FA
Reporter abuse_ch
Tags:img Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: smarthost1.gohsphere.com
Sending IP: 173.0.137.124
From: PAGOS <pagos@carvil.com.mx>
Subject: Re: DEVOLUCIÓN DE PAGO TT (Ref 0180066743)
Attachment: informe bancario.img (contains "informe bancario.PDF.bat")

Intelligence

File Origin
# of uploads :
1
# of downloads :
326
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b2581a526dcf63422c4a4b5e900040d14ed72378305d678508d8b6449a3900e4/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-12-29 20:13:58 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wjmbuutnz5ruelckjnpjaaca2fhnoi3ygbowpbii3c3ejgrzadsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

img b2581a526dcf63422c4a4b5e900040d14ed72378305d678508d8b6449a3900e4

(this sample)

Loki

Executable exe 8bbd910cc31c0c11e4b7a83df4ae39744d4a0643c744abd0726cb747cb639ed6

  
Dropping
MD5 8d006ba73b1d7747b0bb58a3635006fb
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8bbd910cc31c0c11e4b7a83df4ae39744d4a0643c744abd0726cb747cb639ed6

Comments