MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3994da0be3fc42ae122dd471da8ad1890cc96d007f9e668a6dd405a26e3a519. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3994da0be3fc42ae122dd471da8ad1890cc96d007f9e668a6dd405a26e3a519
SHA3-384 hash: caf6680e16bcf33f9138c992ad6cdf7775ed73611ce3ea758355af13b734f6e5d08824c579c3201648d5ec64e8576c74
SHA1 hash: 97bdfe9c1f1520b691c4e16feb17e34a3e9800af
MD5 hash: 20c181b6de00c103cb45ec97be2b51e5
humanhash: six-happy-jig-blue
File name:2020_06_21_ORDER_PDF.gz
Download: download sample
Signature Loki
Create hunting rule
File size:370'927 bytes
First seen:2020-06-22 05:50:19 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:NdBwWhLlzszxZwesMBLPPyTu1R06qmYiCMBSU0RNvdXdsMCaono8IwA:NX1JzszxeM0uFaMeFqMJopIN
TLSH BA8423868C56BA85FC30E73AEE51BA4FE366D42BB7502D8F08D5ABCD45BEE40B711110
Reporter cocaman
Tags:gz Loki


Avatar
cocaman
Malicious email
From: info@progresscomp.com <info@progresscomp.com>
Received: from progresscomp.com (62-210-77-107.rev.poneytelecom.eu [62.210.77.107])
Date: 21 Jun 2020 19:27:17 -0700
Subject: RFQ 17938 FOR REF-20200621
Attachment: 2020_06_21_ORDER_PDF.gz

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d3994da0be3fc42ae122dd471da8ad1890cc96d007f9e668a6dd405a26e3a519/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-22 05:52:06 UTC
File Type:
Binary (Archive)
Extracted files:
266
AV detection:
35 of 48 (72.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2omu3if6h7ccvyjc3vdr3kfndcimzfwqa746m2fg3vafujxduumq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz d3994da0be3fc42ae122dd471da8ad1890cc96d007f9e668a6dd405a26e3a519

(this sample)

Loki

Executable exe 14864c1a28697979e5aaa1c80ab16a85b5fb211e22285f99fd7c4eed517b8062

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 14864c1a28697979e5aaa1c80ab16a85b5fb211e22285f99fd7c4eed517b8062
  
Dropping
Loki

Comments