MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f2117c70cf068b1cf96a9665b4e7c33b635a3eeedab95ba62e1eca47fc7c894. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f2117c70cf068b1cf96a9665b4e7c33b635a3eeedab95ba62e1eca47fc7c894
SHA3-384 hash: e7df9eddf1531298b730ea6d88cd8adbbbc3758ae970661092d270eef7bfe88081f829f82ab69f335cf0a2555cc31ae4
SHA1 hash: 1230f0fa1c4de97a88fa58c7e2112de87bf3d024
MD5 hash: af5b720fa7015e36a5123c782c3dd535
humanhash: tennessee-social-oregon-dakota
File name:covid-19.pdf.zip
Download: download sample
Signature Loki
Create hunting rule
File size:368'269 bytes
First seen:2020-08-14 10:08:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:XzED4flff+rn88tjggC0Cg/It0u+H7WFfndDwEJay+wigNBobsj2f6GN28cbU/BC:XzEcfxQnpjgoQb+qfdJJay7h5j2tNKYo
TLSH EC74232EE81CE528325E9E83C0D7A136B1D160DAD4D1D4BDAC279593619F3B28B1F1F2
Reporter abuse_ch
Tags:COVID-19 geo GRC Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.proing.si
Sending IP: 37.61.201.120
From: Υπουργείο Υγείας και Πρόνοιας (Ελλάδα) <covid-19@moh.gov.gr>
Reply-To: covid-19@moh.gov.gr
Subject: Δωρεάν διανομή προστατευτικού εξοπλισμού Covid-19 (Υπουργείο Υγείας και Πρόνοιας (Ελλάδα))
Attachment: covid-19.pdf.zip (contains "covid-19.pdf.exe")

Loki C2:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0f2117c70cf068b1cf96a9665b4e7c33b635a3eeedab95ba62e1eca47fc7c894/
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 10:10:07 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b4qrprym6buldt4wvftfwtt4go3dli7o5wvzlotc4hwki76hzcka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0f2117c70cf068b1cf96a9665b4e7c33b635a3eeedab95ba62e1eca47fc7c894

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 0f2117c70cf068b1cf96a9665b4e7c33b635a3eeedab95ba62e1eca47fc7c894

(this sample)

Loki

Executable exe ba4979a761ce050060eaa66bd9506fda6a28c30a0ad727e1cbec0a3fed194f9b

  
Dropping
MD5 fd9fe48458b2db2cd76b6c98d60d5aac
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ba4979a761ce050060eaa66bd9506fda6a28c30a0ad727e1cbec0a3fed194f9b

Comments