MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb4b4fccbf40865253e324d5ca566829ee8f1d63fb3cfecf9eab5e02bea9d23c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb4b4fccbf40865253e324d5ca566829ee8f1d63fb3cfecf9eab5e02bea9d23c
SHA3-384 hash: 3d01989847adb0231d4d4accb9dacea28b2f2b54a0450f3aac801153952edd32ddca327809eb655c341f44742ec7d255
SHA1 hash: a7f61fcb947f5e499e6d791f3b4c8b114c6daa11
MD5 hash: 31533b1a65919342c8a78cc4dc1bd8a7
humanhash: blue-nineteen-utah-mockingbird
File name:0070620200012-pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:459'189 bytes
First seen:2020-07-08 06:18:11 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:C/5UjRzU0qgyolrgdOCGmdm8XQnk6BPmuLNa:C6xU0qg76VXQnnBPho
TLSH C8A423935DF228774BD032EA4D8839E52F7463B2615A10F92DAD6BDC3D08F56B0A7423
Reporter abuse_ch
Tags:BGD geo gz HSBC Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: smtpgw2.nayatel.com
Sending IP: 203.82.48.12
From: HSBC Bangladesh <contact@hsbc.com.bd>
Subject: হস্তান্তর এর প্রমাণ !!!
Attachment: 0070620200012-pdf.gz (contains "0070620200012-pdf.exe")

Loki C2:
http://mygreencity.in/scripts/Panel/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb4b4fccbf40865253e324d5ca566829ee8f1d63fb3cfecf9eab5e02bea9d23c/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-08 06:20:07 UTC
AV detection:
31 of 48 (64.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7nfu7tf7icdfeu7detk4uvtifhxi6hld7m6p5t46vnpafpvj2i6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz fb4b4fccbf40865253e324d5ca566829ee8f1d63fb3cfecf9eab5e02bea9d23c

(this sample)

Loki

Executable exe 1864cfb59340419df0dda66c8a9a5912878bef414773e0569d52cde18fdff85c

  
Dropping
MD5 096a791524b9ff0ee657822bc7c4636b
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1864cfb59340419df0dda66c8a9a5912878bef414773e0569d52cde18fdff85c

Comments