MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc3e2f7cc6f9ae027adfec912f9f5b0e940512b73bb3419f9db4ee9d6ac0a84d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc3e2f7cc6f9ae027adfec912f9f5b0e940512b73bb3419f9db4ee9d6ac0a84d
SHA3-384 hash: 3b67a38dfe40ca7173ad8b7b23f0309ba9687c4f81df9184972c9859f11065e3ac5ab2b39a19c41d109ee04f0122ca9d
SHA1 hash: 0f66514f6d3bde763275fe00ece2e94dddbb5c17
MD5 hash: b6b51be0520bfcaad93b457a441688e3
humanhash: delta-eleven-illinois-beryllium
File name:PAYMENT_ADVICE NCB6290003457110200.gz
Download: download sample
Signature Loki
Create hunting rule
File size:354'821 bytes
First seen:2020-06-08 05:08:19 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:qaJIiGfiGP4E2b7z/TU4QyAB6UeZSlxHL7sb/TwhhVYlgrsBgNLeoDaHCBMJPoa:qaJIiUizL/frk6xw7sbTwjVYIsBgNLeL
TLSH E974238F01878A4B1219E31849DE7FAEBFD0D416B18185B8BD33192D2F617D197A8CDB
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server30.a2zcreatorz.com
Sending IP: 72.18.130.163
From: NCB البنك الأهلي التجاري‎ <cutting@casual.com.pk>
Subject: PAYEE ADVICE FROM NCB FOR CUSTOMER REF: NCB6290003457110200
Attachment: PAYMENT_ADVICE NCB6290003457110200.gz (contains "PAYMENT_ADVICE NCB6290003457110200.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 05:10:06 UTC
AV detection:
36 of 48 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zq7c67gg7gxae6w75sis7h23b2kakevxhozudh45wtxj22wavbgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz cc3e2f7cc6f9ae027adfec912f9f5b0e940512b73bb3419f9db4ee9d6ac0a84d

(this sample)

Loki

Executable exe 4ca9b45f58ea29095253e13f744267b11cb632aed3aad9e3e4abee0d153d9d38

  
Dropping
MD5 38c3d61edf3f095d58a36a65ba15c8e8
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4ca9b45f58ea29095253e13f744267b11cb632aed3aad9e3e4abee0d153d9d38

Comments