MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed76a52b2bda1f026bea2c93e6357f60325246ffd5e03daf8efc021fc2f0cf80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed76a52b2bda1f026bea2c93e6357f60325246ffd5e03daf8efc021fc2f0cf80
SHA3-384 hash: 2ed034f869450580e99dc8f38bda2568fd5b724136db9ab4e11dcca141d21291a94e31704b8c83b50e0a58a00e39cbef
SHA1 hash: 87646e937b8dbb58bf2354f53be094041102a9b7
MD5 hash: 13ada71bec1f280d5cdcfda7beaae589
humanhash: wolfram-west-low-batman
File name:Remittance Advice_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:362'346 bytes
First seen:2020-06-08 05:42:36 UTC
Last seen:2020-06-08 06:21:34 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:TecbCG6aeKB7eLjO7qMmvGCQ4S6lKF7P37Jb2TbzE63xD0UW/pOQJcIwAtZ9:C0T5BUwbC/w7PLJb8EDOFlAH9
TLSH 0374231D57153228CA8D88F8AD5FCFDA406C14EA7CBEDDE5C62A3F160E591CB240E698
Reporter jarumlus
Tags:Loki

Intelligence

File Origin
# of uploads :
3
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 00:34:00 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5v3kkkzl3ipqe27kfsj6mnl7mazferx72xqd3l4o7qbb7qxqz6aa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip ed76a52b2bda1f026bea2c93e6357f60325246ffd5e03daf8efc021fc2f0cf80

(this sample)

Loki

Executable exe fe0ae9a53caacfc61d58c1dd7e655758d29c3c817344a87e2bbdd90a1e8fe17d

  
Dropped by
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fe0ae9a53caacfc61d58c1dd7e655758d29c3c817344a87e2bbdd90a1e8fe17d
  
Dropping
MD5 2111cc01553ff94bf3fbaf3d2976934e

Comments