MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe974b02ead7c2e466973a042c8fa4a9779afdae0810ca538e6207465d470f3b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe974b02ead7c2e466973a042c8fa4a9779afdae0810ca538e6207465d470f3b
SHA3-384 hash: 7ba89e926f99e6d16ed1304b9add44f75b0b52dabbc995463d3a0837996e1144d22f6a230d15d2d9ed63157e14682d42
SHA1 hash: ce962259fe5826ad17ac0fc7c98eccb811f9ce5d
MD5 hash: ef4761cd6a71054b43acad6d713d7abb
humanhash: eight-idaho-enemy-march
File name:Extract_MK22AXX_SWIFT_98_2020.09.23.img.iso
Download: download sample
Signature Loki
Create hunting rule
File size:1'900'544 bytes
First seen:2020-09-25 13:19:52 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:NRgV9lX4ePztJzKe4QTnExJrP61c5sY1HVHTJxolLkXtVDJDhuecA7PGEWOrT4G/:NR6bbJR7Oyu5sw1NeLut/MAyVOr6k
TLSH B695E123E2A14837C0632979DD0B5774A927BE503A24AFC62BF9DC48BF3975138252D7
Reporter abuse_ch
Tags:iso Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: sv17.voztelia.net
Sending IP: 5.135.121.130
From: Komercijalna Banka <support_denarisk_pp@kb.com.mk>
Subject: Re: Interbank transfer payment
Attachment: Extract_MK22AXX_SWIFT_98_2020.09.23.img.iso (contains "Extract_MK22AXX_SWIFT_98_2020.09.23.exe")

Loki C2:
http://pkiz.xyz/V3/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.5441.2851.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.BackDoor.SpyBotNET.25.24003.12228.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fe974b02ead7c2e466973a042c8fa4a9779afdae0810ca538e6207465d470f3b/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-09-25 12:06:24 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=72luwaxk27boizuxhicczd5evf3zv7nobaimuu4omidumxkhb45q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fe974b02ead7c2e466973a042c8fa4a9779afdae0810ca538e6207465d470f3b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

iso fe974b02ead7c2e466973a042c8fa4a9779afdae0810ca538e6207465d470f3b

(this sample)

Loki

Executable exe 7513ca9ae16b3dab78a70cd6c5ff6c58a3107256387a1db597e1c7945037e17b

  
Dropping
MD5 ccf8a20a1000a59693c36654ba595f7e
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7513ca9ae16b3dab78a70cd6c5ff6c58a3107256387a1db597e1c7945037e17b

Comments