MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b63b6dfb631fcc1bffc6430dee5aa02ab4f50fe3d53588bfb910488066cec2c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b63b6dfb631fcc1bffc6430dee5aa02ab4f50fe3d53588bfb910488066cec2c9
SHA3-384 hash: 02a255bd3a4e2e6af7d233b1e20105bf7b5edc49a52747ce408a6c69446b690dc3f31e50834374504259276ebe20d63a
SHA1 hash: 463b6d746f91a896e9e47eda4e1a1e19703713cb
MD5 hash: 6e1b547acd051167ffb8ad45e71f0986
humanhash: pizza-floor-lion-seven
File name:SOLICITUD DE OFERTA 05-08-2020.pdf.zip
Download: download sample
Signature Loki
Create hunting rule
File size:413'270 bytes
First seen:2020-08-05 12:11:34 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:daT5FFognMXtwDbY/Q4BINnpaBQ+mwa/q:daT5FFr4pQ4BWnpmmwf
TLSH 7694236264DD7E716AB20A379706EF310E79A05AF6270FB84ACAF006C77DD14825CED0
Reporter abuse_ch
Tags:geo Loki PER zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: host1.navi-global.com
Sending IP: 185.58.73.74
From: Universidad Nacional de San Marcos <admin@unmsm.edu.pe>
Subject: URGENT: SOLICITUD DE OFERTA (Universidad Nacional de San Marcos) EUI894/BU400
Attachment: SOLICITUD DE OFERTA 05-08-2020.pdf.zip (contains "SOLICITUD DE OFERTA 05-08-2020.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b63b6dfb631fcc1bffc6430dee5aa02ab4f50fe3d53588bfb910488066cec2c9/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 12:13:05 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wy5w363dd7gbx76gimg64wvafk2pkd7d2u2yrp5zcbeiazwoyleq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b63b6dfb631fcc1bffc6430dee5aa02ab4f50fe3d53588bfb910488066cec2c9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip b63b6dfb631fcc1bffc6430dee5aa02ab4f50fe3d53588bfb910488066cec2c9

(this sample)

Loki

Executable exe 66389b1f3694d4b7074b6204b99a48425f4ba35c3bab1a40182da6cf633a8f8c

  
Dropping
MD5 1c92af6959c31f9256f76be40f1d295a
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 66389b1f3694d4b7074b6204b99a48425f4ba35c3bab1a40182da6cf633a8f8c

Comments