MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3bc7773a2afa6e3bbaee9fa33b3b54b1d02c5facf56be734531b62e53e62867. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3bc7773a2afa6e3bbaee9fa33b3b54b1d02c5facf56be734531b62e53e62867
SHA3-384 hash: f7c1665572573df6552abe767b34fc3d00c4b678de480ffe2f4c968219f9103b10c0a048aa5d727f4551f739126918d9
SHA1 hash: e8ca424634fd19cea471caeaa9a9142d9187773a
MD5 hash: 7bc9454505329122c932c6aaa6e33f1e
humanhash: fifteen-leopard-lactose-black
File name:INVOICE DOCS.rar
Download: download sample
Signature Loki
Create hunting rule
File size:45'366 bytes
First seen:2020-10-05 12:01:31 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:1YyyaN2wbTNNKRPeP+fvfOwg4hJoqTkb2isQCN/mnGsyv+4LNQjY6X1++fGxjXmn:FyaN2wbqRG+fOwr2YPQCoGdv+jj2jiB
TLSH D113F158F7FED87D7EA01EC1577E06E9B99DDD98349848E840D80C41E1ECBD628186F1
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: dfl0.520.mulxi.ml
Sending IP: 188.166.214.15
From: CONSOL <consolalliance.com.au>
Reply-To: consolalliance.com.au
Subject: RE: UPDATED DEBIT NOTE (AHO134)
Attachment: INVOICE DOCS.rar (contains "ok1.exe")

Loki C2:
http://bmaudio.com.vn/ok1/need/work/Panel/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3bc7773a2afa6e3bbaee9fa33b3b54b1d02c5facf56be734531b62e53e62867/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 07:53:07 UTC
AV detection:
37 of 48 (77.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wo6ho45cv6toho5o5h5dhm5vjmoqfrp2z5ll442fgg3c4u7gfbtq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b3bc7773a2afa6e3bbaee9fa33b3b54b1d02c5facf56be734531b62e53e62867

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar b3bc7773a2afa6e3bbaee9fa33b3b54b1d02c5facf56be734531b62e53e62867

(this sample)

Loki

Executable exe 89aa89c61fae1a3590e3e0e60bac9191774881f0cc931a4609151067520bb293

  
Dropping
MD5 8c04d4003416e6d404a7c089e8eb444b
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 89aa89c61fae1a3590e3e0e60bac9191774881f0cc931a4609151067520bb293

Comments