MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c09b9f2fc922f836b3a185679235e2cf182380ab3ef450b20f60529f08c9520b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c09b9f2fc922f836b3a185679235e2cf182380ab3ef450b20f60529f08c9520b
SHA3-384 hash: 5a33cddb868702e8d2e18e126b64fdfdf55b9f1431f5fb412ee6fa92b0f2e748aa07d937156bac8f1e0c9eae15fb0ede
SHA1 hash: f174551a4332ee28ceb67f7a3bdd92edd6c57ea6
MD5 hash: ec3df2119ac70dc5881bfcd5f071841e
humanhash: solar-lion-east-edward
File name:JULY_INVOICE_PTV2201900000512_PTV2201900000603_PAST_DUE.zip
Download: download sample
Signature Loki
Create hunting rule
File size:415'531 bytes
First seen:2020-08-06 05:26:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:kNMd+GnU0RV+rEULbrSehUjUMbFlSD3Qmk:+GUUgEObvCjfqQmk
TLSH 9994231FB4AD9510BAFB7F8D582B0E45A5507B611CCA6BA80CDC698B9720D804D37FCB
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server.globalhpbatam.com
Sending IP: 31.14.140.26
From: qa@globalhpbatam.com
Subject: *Outstanding Invoices of July'2020*
Attachment: JULY_INVOICE_PTV2201900000512_PTV2201900000603_PAST_DUE.zip (contains "JULY_INVOICE_PTV2201900000512_PTV2201900000603_PAST_DUE.exe")

Loki C2:
http://sieqwarteg.com/chief/chief2/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c09b9f2fc922f836b3a185679235e2cf182380ab3ef450b20f60529f08c9520b/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 23:36:10 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ycnz6l6jel4dnm5bqvtzenpcz4mchaflh32fbmqpmbjj6cgjkifq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c09b9f2fc922f836b3a185679235e2cf182380ab3ef450b20f60529f08c9520b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip c09b9f2fc922f836b3a185679235e2cf182380ab3ef450b20f60529f08c9520b

(this sample)

Loki

Executable exe b43401e5899dfd0a893c0b10b9c531fb4d6562d14b3c89462106009a679b64a2

  
Dropping
MD5 6ced103ee3a67c8c136846b30bf41206
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b43401e5899dfd0a893c0b10b9c531fb4d6562d14b3c89462106009a679b64a2

Comments