MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fce1d2ef1b91a2f2bb6601fd37e1dff8998af1479febc41ec115139f717ac7d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fce1d2ef1b91a2f2bb6601fd37e1dff8998af1479febc41ec115139f717ac7d0
SHA3-384 hash: 302dd2acaaec181aa674f70f6152c138f521576f1097def9fe5d2692a72ef672687058f13b43c3537e92e93ba4539be8
SHA1 hash: 52c7336e1a24c942c8d0f450a11214edbae0ab6d
MD5 hash: c13ed3b0b70a64891fce812e3b266882
humanhash: wyoming-spaghetti-asparagus-fillet
File name:PO.pdf.z
Download: download sample
Signature Loki
Create hunting rule
File size:166'095 bytes
First seen:2021-05-31 06:50:03 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 3072:ThU4P6INSuKzohK+9s/qid2+hZDp/XvEwbNE9u/GYiMp:T+4CIQzv+9s/qw2y/X1/cE
TLSH 5EF312CCE50251D5AA9E78A05DA00182D62DFF85BF813473D3E7435D83F6B26271E9A2
Reporter cocaman
Tags:Loki z


Avatar
cocaman
Malicious email (T1566.001)
From: "Elie Abdel Ahad <sales@iran-bitumen.com>" (likely spoofed)
Received: "from iran-bitumen.com (unknown [103.153.182.81]) "
Date: "30 May 2021 19:00:44 -0700"
Subject: "Re: Re: PI"
Attachment: "PO.pdf.z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fce1d2ef1b91a2f2bb6601fd37e1dff8998af1479febc41ec115139f717ac7d0/
Threat name:
Win32.Worm.SpyBot
Create hunting rule
Status:
Malicious
First seen:
2021-05-31 06:50:13 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
8 of 45 (17.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7tq5f3y3sgrpfo3gah6tpyo77cmyv4kht7v4ihwbcujz64l2y7ia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fce1d2ef1b91a2f2bb6601fd37e1dff8998af1479febc41ec115139f717ac7d0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z fce1d2ef1b91a2f2bb6601fd37e1dff8998af1479febc41ec115139f717ac7d0

(this sample)

Loki

Executable exe fc4755ecd430695e6936cd679d00782d9f1ffcb660401061db3ed6b1a15b0255

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fc4755ecd430695e6936cd679d00782d9f1ffcb660401061db3ed6b1a15b0255
  
Dropping
Loki

Comments