MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd86670a4b4a751197724f8619ebba0c5ba377ce568e90fd9b1b928b0f16278d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd86670a4b4a751197724f8619ebba0c5ba377ce568e90fd9b1b928b0f16278d
SHA3-384 hash: 5c6254feaa82509d8b97bd22cc2a25f5476597ebb0b2ce7f5e87dda110fc9605311f0528753a227a61cac7da401af409
SHA1 hash: 9f98b811b2a5a9c22a52a3115f0acfe1270cbaa3
MD5 hash: dc1a796cc3e8bd0893ae8f5300902e25
humanhash: diet-item-white-colorado
File name:INQUIRY 824629.ace
Download: download sample
Signature Loki
Create hunting rule
File size:423'094 bytes
First seen:2021-03-22 06:08:33 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 12288:Zj70CfHX/qsh29YchbL2cIk3HLJydbor5aAoPvD/Q:Z3LPq2GYAf2vk3MUr5ajPvDI
TLSH 679423406982E0733C1B916FB2FEC991C5E9CFC28A7431A9C51D3039D57D1BBAB86E58
Reporter cocaman
Tags:ace Loki


Avatar
cocaman
Malicious email (T1566.001)
From: "Anand Gupta <Anand@324.bnjo.cf>" (likely spoofed)
Received: "from hp0.324.bnjo.cf (hp0.324.bnjo.cf [159.89.139.236]) "
Date: "Mon, 22 Mar 2021 03:15:09 +0000"
Subject: "INQUIRY 824629"
Attachment: "INQUIRY 824629.ace"

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bd86670a4b4a751197724f8619ebba0c5ba377ce568e90fd9b1b928b0f16278d/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-22 06:09:07 UTC
File Type:
Binary (Archive)
Extracted files:
43
AV detection:
15 of 47 (31.91%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xwdgocsljj2rdf3sj6dbt252brn2g56ok2hjb7m3dojiwdywe6gq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/bd86670a4b4a751197724f8619ebba0c5ba377ce568e90fd9b1b928b0f16278d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

ace bd86670a4b4a751197724f8619ebba0c5ba377ce568e90fd9b1b928b0f16278d

(this sample)

Loki

Executable exe c606b9a9266efd06f8db163bced0cea6e69bcaf88185f29bb364289f7a067eaf

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c606b9a9266efd06f8db163bced0cea6e69bcaf88185f29bb364289f7a067eaf
  
Dropping
Loki

Comments