MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d643b3c4c4ec221c4dbbf1294d026c14ea1e44232fc4bece6ad8eed2ab7de89e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d643b3c4c4ec221c4dbbf1294d026c14ea1e44232fc4bece6ad8eed2ab7de89e
SHA3-384 hash: 8e44f65e4917c34be3976a483b266d696f2ff30a3d4e00deb1ca1d36fc33143f7c86161d54a3d0ef6d5bb64dc3a331e2
SHA1 hash: 8f350e8019d631fd6e0871d34c81360058265d50
MD5 hash: 112cebf6187a2d2b9d3e6f4bba4e914f
humanhash: white-bluebird-arizona-cup
File name:22017.r00
Download: download sample
Signature Loki
Create hunting rule
File size:329'154 bytes
First seen:2020-07-24 13:22:24 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:RJitzQO+KHeKs+ldBlaqJCw7xd3yq3ukbxJl2tc+kSs7xUimDQ5qW:RJeDs+ldBljkOd3puoJk6+kD7Kim051
TLSH 7E6423739BB364A9E31A829A340CF1A57D41925E6AFB30A973C092737D1C530E35CB67
Reporter abuse_ch
Tags:Loki r00


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail0.410.gataminuet.cf
Sending IP: 206.189.135.228
From: ACCOUNT <coimbatore@gmsworldwide.com>
Subject: BANK COPY
Attachment: 22017.r00 (contains "22017.exe")

Loki C2:
http://mecharnise.ir/da20/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d643b3c4c4ec221c4dbbf1294d026c14ea1e44232fc4bece6ad8eed2ab7de89e/
Threat name:
Win32.Trojan.DelfFareIt
Create hunting rule
Status:
Malicious
First seen:
2020-07-24 13:24:06 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2zb3hrge5qrbytn36euu2atmctvb4rbdf7cl5ttk3dxnfk355cpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.66
Link:
https://yomi.yoroi.company/submissions/d643b3c4c4ec221c4dbbf1294d026c14ea1e44232fc4bece6ad8eed2ab7de89e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

r00 d643b3c4c4ec221c4dbbf1294d026c14ea1e44232fc4bece6ad8eed2ab7de89e

(this sample)

Loki

Executable exe cfef6a351694bc6791363017e38cb725e77fef94af81a03a67186b97f1b3902a

  
Dropping
MD5 5d9c8d003a8df372d58ac64e490f60c9
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cfef6a351694bc6791363017e38cb725e77fef94af81a03a67186b97f1b3902a

Comments