MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f22d32d0ae956bde7a04018ffd45cdb923723026441b3201cf5fb129a40ebbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f22d32d0ae956bde7a04018ffd45cdb923723026441b3201cf5fb129a40ebbf
SHA3-384 hash: 5def968657e26dbd248d230d44e9b8cbab9e55e09e357db46ba4966f8da3a80d0b3e1b2ed3e5bc501dfb89ec2f5527fb
SHA1 hash: 16e252ea2ef0f497a5cdb729863e1e197a079860
MD5 hash: 9c9584fc8bb7704d2460657ef7e23562
humanhash: snake-princess-delta-missouri
File name:BANK RECIEPT.gz
Download: download sample
Signature Loki
Create hunting rule
File size:202'682 bytes
First seen:2020-06-23 14:27:22 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 3072:zy6JIkCp0lWb9e/Hk/Tt1zhr7n3xHDOcsZxm7HMz2kGC24xRguee0rfuyYRwjkjB:2p+cZqErLzhfnhjOJHmgCk3Ip4jB
TLSH 5A14229B5DBFC616D26D3418DA1EF588E108CF8CC00C511BB147AA5FA0E7A3F26358B2
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.befactto.tk
Sending IP: 173.82.168.26
From: admin@befactto.tk
Subject: Payment against INV NO 10253530
Attachment: BANK RECIEPT.gz (contains "BANK RECIEPT.exe")

Loki C2:
http://bobbyfile.gq/Bobby/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f22d32d0ae956bde7a04018ffd45cdb923723026441b3201cf5fb129a40ebbf/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-23 14:28:04 UTC
AV detection:
17 of 30 (56.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d4rnglik5fll3z5aiamp7vc43ojdoiycmra3gia46x5rfgsa5o7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 1f22d32d0ae956bde7a04018ffd45cdb923723026441b3201cf5fb129a40ebbf

(this sample)

Loki

Executable exe a9055377b8ebe2b2d3890f4746a837610890f0453a487bdebd22a619737b1210

  
Dropping
MD5 df198999a67518d892627305d3b88c21
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a9055377b8ebe2b2d3890f4746a837610890f0453a487bdebd22a619737b1210

Comments