MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f13b205bcfa52e7c434fbd3b1bf42501d43b1e29abc55ff93ab2a19faf5a23d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f13b205bcfa52e7c434fbd3b1bf42501d43b1e29abc55ff93ab2a19faf5a23d6
SHA3-384 hash: 9d29172b57114e3e84436fe84efb382ade54d0411345f4e79fa32a179965bf1a4105ea3b78fca4676fe250767b6e6391
SHA1 hash: 786e7a9bc0c88a2ec7abc2f0cab7dae9d08c074e
MD5 hash: 2e42e36448bad4cbcf0386bd7c1710ef
humanhash: michigan-failed-bacon-queen
File name:Filled Agreement.pdf.z
Download: download sample
Signature Loki
Create hunting rule
File size:339'557 bytes
First seen:2020-07-07 09:19:43 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:auLJH62QOuTJoOas7/IBcH2YNFNeA1uFKZa24nnDCmqtzowaSPthshyVB:auLJvST2ODIBcvF0AZQ24lqu9Sjshy/
TLSH 2C74235BEB1E7B68BE0DEAEBF1E1786393046F865F05C5055C4E72AC9D83D088D9248C
Reporter abuse_ch
Tags:Loki z


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mailer12-1.incnets.com
Sending IP: 210.6.92.81
From: ASHOK SHARMA (Accounts Team) <accounts@manna.corp.com.hk>
Subject: Filled Agreement
Attachment: Filled Agreement.pdf.z (contains "Filled Agreement.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f13b205bcfa52e7c434fbd3b1bf42501d43b1e29abc55ff93ab2a19faf5a23d6/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 09:21:06 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6e5saw6puuxhyq2pxu5rx5bfahkdwhrjvpcv76j2wkqz7l22epla._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z f13b205bcfa52e7c434fbd3b1bf42501d43b1e29abc55ff93ab2a19faf5a23d6

(this sample)

Loki

Executable exe bdcc6a8591676b9d879a02bcd318bfdfa260769433865db3948d929f79b5e1fa

  
Dropping
MD5 ebb2e201fa781be48767800abcd146be
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bdcc6a8591676b9d879a02bcd318bfdfa260769433865db3948d929f79b5e1fa

Comments