MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 024859f35939f6839f95f5bc6fb0f822804410a9044f39b690c7467da4f8e89d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 024859f35939f6839f95f5bc6fb0f822804410a9044f39b690c7467da4f8e89d
SHA3-384 hash: c91d14289b9e816a81037779aa4ea8251d9d5c77a752321a2438ec6194c255b25fdf380dbd14e8c2797b8c8594c7b995
SHA1 hash: fa9334ba3ebd1eeb2034426acf4ab0ee8c398cc0
MD5 hash: f4a167a73d869ceeec34ad51fcacd918
humanhash: william-fish-river-finch
File name:aLx0lOxUWbgHIMS.rar
Download: download sample
Signature Loki
Create hunting rule
File size:238'810 bytes
First seen:2020-08-19 11:23:44 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:2nixkqFVtNZ7wumM/LAkXyH497FdBRT3IaUMj:GitF1misS79JdHT3Ia1
TLSH A734239EDC87333F3C8F656EE32797DDE91B5A11818102FA869119564B1C83AC5BE3E0
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: gmail.com
Sending IP: 174.138.183.34
From: Sid Sestoso <sidsastoso@gmail.com>
Reply-To: sidsastoso@gmail.com
Subject: Urgent products confirmation
Attachment: aLx0lOxUWbgHIMS.rar (contains "aLx0lOxUWbgHIMS.exe")

Loki C2:
http://geeccaships.ga/africaone/logs/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/024859f35939f6839f95f5bc6fb0f822804410a9044f39b690c7467da4f8e89d/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 11:24:09 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ajeft42zhh3ihh4v6w6g7mhyekaeiefjarhttnuqy5dh3jhy5coq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/024859f35939f6839f95f5bc6fb0f822804410a9044f39b690c7467da4f8e89d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 024859f35939f6839f95f5bc6fb0f822804410a9044f39b690c7467da4f8e89d

(this sample)

Loki

Executable exe 75f2eef98024eb1feff0b4d2b71265cb306c6781e5536e3f86396343515296c7

  
Dropping
MD5 718c40532786fa809c9e49ebf3b9fda6
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 75f2eef98024eb1feff0b4d2b71265cb306c6781e5536e3f86396343515296c7

Comments