MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06cc817eb5655934e2929b69d1e89da641fe99c90fdd613b6c7245cdac50ef47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 06cc817eb5655934e2929b69d1e89da641fe99c90fdd613b6c7245cdac50ef47
SHA3-384 hash: e213e6c279e6440f0cc8f2fac3a0b8f9bded92248549dabd73918f21a1e0f5171e2ac5a6acf8a2c7d9e9c0881c7f0df9
SHA1 hash: 606669b5c536d19e0f51255eb45dcea5517251f8
MD5 hash: 9480967ae73950b7aaee723cc802d4ad
humanhash: mexico-magnesium-island-seven
File name:Letter of Conformity.pdf.z
Download: download sample
Signature Loki
Create hunting rule
File size:291'343 bytes
First seen:2020-05-22 13:43:06 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:c1eXsAcDxj4Vk3MFKwBKQnUaNKlffDdjdtzgPabNz7tfYUGUMfqEpaV:co1MxvMFnVyfxhxRbNpZGUMfq3V
TLSH 4C542305EE09F46A700218DC3E71BB4FAA9A0F6DAF319BE316F0E909B4DD7107D44A65
Reporter abuse_ch
Tags:Loki z


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail001.datapar.com
Sending IP: 170.238.19.37
From: Stefan Knorsch <sale@forumsa.gr>
Subject: INQUIRY FOR Nitril and Latex Gloves & KN95/FFP2 Face mask.
Attachment: Letter of Conformity.pdf.z (contains "Letter of Conformity.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 14:35:51 UTC
File Type:
Binary (Archive)
Extracted files:
296
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z 06cc817eb5655934e2929b69d1e89da641fe99c90fdd613b6c7245cdac50ef47

(this sample)

Loki

Executable exe a4b586228045bc0e79d6013f2c31cb0eb2364ef536e26744bb18ce8c04cdd693

  
Dropping
MD5 aa3fd4771362710e3cab3e23bef768e4
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a4b586228045bc0e79d6013f2c31cb0eb2364ef536e26744bb18ce8c04cdd693

Comments