MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bafd29758e6e7626881655d9761661693ca0ee58914dc22e3d168cfdc2b02c61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bafd29758e6e7626881655d9761661693ca0ee58914dc22e3d168cfdc2b02c61
SHA3-384 hash: af853f17f2569029fb724e1343d74d0cb93c6e627c9776540ba7ae5d23d5b17cd26f504eb92b4258984acf16667dd2e8
SHA1 hash: fd8bcdab15afd63b863d5ddefaffaf49f74b6aa2
MD5 hash: ee3e1fe7db4f029c7417b32e0a827dea
humanhash: papa-lion-bravo-ink
File name:Quotations Request 06_234914.iso
Download: download sample
Signature Loki
Create hunting rule
File size:749'568 bytes
First seen:2020-07-07 09:43:59 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:3xK33heNnvkxmaaeLawFMFnu93H7DMxFQe0GNGz:InhUv6JaAj37DMk24z
TLSH 52F49D16F2D07833D16A163D8C0B6677682AFD412A24DA463BE8DC785F396413F392E7
Reporter abuse_ch
Tags:Endurance iso Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: qproxy2.mail.unifiedlayer.com
Sending IP: 69.89.16.161
From: Martina Trabalon <martina.trabalon@euautomation.com>
Subject: AT0009165 // Quote intprotc // PURCHASE ORDER US-J42169
Attachment: Quotations Request 06_234914.iso (contains "Quotations Request.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Win32.Herz.B.18879.21615.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bafd29758e6e7626881655d9761661693ca0ee58914dc22e3d168cfdc2b02c61/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 09:45:15 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xl6ss5monz3cncawkxmxmftbne6kb3sysfg4elr5c2gp3qvqfrqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

iso bafd29758e6e7626881655d9761661693ca0ee58914dc22e3d168cfdc2b02c61

(this sample)

Loki

Executable exe 5bc57905e78d6b5e5485412119f7baa42e2355512269857dc6c3823a555d01bf

  
Dropping
MD5 2af9077a756600bf6ff971b864d84f4a
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5bc57905e78d6b5e5485412119f7baa42e2355512269857dc6c3823a555d01bf

Comments