MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ddb0fc08e16c5739288b7f30a9eff82a8aab2f5a488e115d01da89d86f8ca4a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ddb0fc08e16c5739288b7f30a9eff82a8aab2f5a488e115d01da89d86f8ca4a2
SHA3-384 hash: e8b585117b738265632f2cbad68dd647f54dc28e2cad06e91909ffc8df46821b7812554de27def1244994d9d4ba63cd7
SHA1 hash: 0f79873797ed1de470afb2a90773f64400baed16
MD5 hash: 0b286d0c8d100038fbe8d8e2d5062a03
humanhash: lion-leopard-thirteen-kansas
File name:P.O_92057318_dted 08.03.21.gz.rar
Download: download sample
Signature Loki
Create hunting rule
File size:388'027 bytes
First seen:2021-03-08 16:01:04 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:fAGzfHiSVoIztZEU1maG0qjrGBgwExheoxuUBEK40YQPnuNkZIh57a8dtu2r/S:fXqIpTJG0qjSBOWUnBYlW2La8qc/S
TLSH 6584232319084EDEC451FAD6A2CD5D285C3F9A291F47D6F091FC2927F2531E9B45C43A
Reporter cocaman
Tags:Loki rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Therma Trading Co, Ltd" <mohamedha@aav.com.eg>" (likely spoofed)
Received: "from mail.aav.local (mail1.aav.com.eg [213.154.48.68]) "
Date: "Mon, 8 Mar 2021 04:58:39 -0500 (EST)"
Subject: "P.O_92057318_dted 08.03.21"
Attachment: "P.O_92057318_dted 08.03.21.gz.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-08 16:01:08 UTC
File Type:
Binary (Archive)
Extracted files:
47
AV detection:
25 of 47 (53.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3wypychbnrltskelp4ykt37yfkfkwl22jchbcxib3ke5q34musra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ddb0fc08e16c5739288b7f30a9eff82a8aab2f5a488e115d01da89d86f8ca4a2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar ddb0fc08e16c5739288b7f30a9eff82a8aab2f5a488e115d01da89d86f8ca4a2

(this sample)

Loki

Executable exe f4f27e005b5381e5d1eb3d1d95cd4ae5c963c7601934254ebe266f08cfaf78d2

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f4f27e005b5381e5d1eb3d1d95cd4ae5c963c7601934254ebe266f08cfaf78d2
  
Dropping
Loki

Comments