MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1bc8db15e5513568e4880e38ccab2efbb5495253693b9b064ae362103b16ea1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1bc8db15e5513568e4880e38ccab2efbb5495253693b9b064ae362103b16ea1f
SHA3-384 hash: 9c8b0536d2d1f7482d1519141a9848746359ddf4b4793a5dea7607e769cd72267c4d68fc1f1534a6fab5c8ecdbfeeeb7
SHA1 hash: 664651f2a13ab38971a8685acd162fcadbb8eb0d
MD5 hash: 1576a0e7ca047108fd173f1a8df3b63e
humanhash: white-uranus-delta-alaska
File name:MOH Contact Form 02-07-2020·pdf.zip
Download: download sample
Signature Loki
Create hunting rule
File size:350'643 bytes
First seen:2020-07-02 06:39:14 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:mzA6VDxW1AGj+aHCHwTGN+SC0GGKodVMpqO5YIC5LznyW7I9hVptlXwhAf:mzA6VDxWhj+/X+SC0GRI6bYFTQnXlf
TLSH CB7423F5ACE16E1D8836CBEEA3201BFF35C985108F5C32E56C688DF264153564A0ABD7
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: dedicado150.zonasprivadasdns.com
Sending IP: 217.61.130.23
From: Joan KANG (MOH) <Joan_KANG@moh.gov.sg>
Subject: URGENT: Request for Information
Attachment: MOH Contact Form 02-07-2020·pdf.zip (contains "MOH Contact Form 02-07-2020·pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Fareit-6863179-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.27245.ZipHeur.HideExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1bc8db15e5513568e4880e38ccab2efbb5495253693b9b064ae362103b16ea1f/
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 01:28:40 UTC
AV detection:
31 of 48 (64.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dpenwfpfke2wrzeiby4mzkzo7o2usustne5zwbsk4nrbaoyw5ipq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 1bc8db15e5513568e4880e38ccab2efbb5495253693b9b064ae362103b16ea1f

(this sample)

Loki

Executable exe 3a0011bd0330be4647b11583df093979c424718e8e9592408a9cfc52581a1187

  
Dropping
MD5 ee9ea69fb03ea71dc8d6c07e0239efe7
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3a0011bd0330be4647b11583df093979c424718e8e9592408a9cfc52581a1187

Comments