MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22dd60538880122e7bdf3460c2c78f3e658e215be52a69de79e17772ad590036. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22dd60538880122e7bdf3460c2c78f3e658e215be52a69de79e17772ad590036
SHA3-384 hash: ce6fd257816a41e1a87a092b4674aecedf1c5779747feb40b29cb7c13526a1a2492e3efd858eb6599e113373b97d4c5d
SHA1 hash: e9f3b94baf234831587e350a5b3cfa3ed0461fe6
MD5 hash: 752500f0ead8103d4f45afaca4f53b94
humanhash: wisconsin-fillet-utah-hotel
File name:PAYMENT.zip
Download: download sample
Signature Loki
Create hunting rule
File size:150'427 bytes
First seen:2020-05-15 07:17:00 UTC
Last seen:2020-05-15 14:16:05 UTC
File type: zip
MIME type:application/zip
ssdeep 3072:KFIeXaxpeKXHQWTTHo6FNozTd7xNwfTKGu6M/orxiKyHAJdbgtgnpQA36IFUU:nDeKXwWTTHCXMuGu6M/otssstEpqit
TLSH 79E313BCC0627EF055E4CC6D8C9024DBC2F88B4DDBCDCDEB876900AC69DA5A95406BB5
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: manda.com
Sending IP: 94.177.232.110
From: "Katty Lynda"<sale02@gmail.com>
Reply-To: <bossweprayforbless@hotmail.com>
Subject: payment Advice
Attachment: PAYMENT.zip (contains "PAYMENT.exe")

Loki C2:
http://beheshtsoft.com/support/nkem/fre.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21085.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Grp
Create hunting rule
Status:
Malicious
First seen:
2020-05-15 09:46:25 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
25 of 48 (52.08%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=elowau4iqajc4667grqmfr4phzsy4ik34uvgtxtz4f3xflkzaa3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 22dd60538880122e7bdf3460c2c78f3e658e215be52a69de79e17772ad590036

(this sample)

Loki

Executable exe 935e06731d9b88fcf33673ae11c9f9d184610aa64a6b7e1da89b1328a34e1b83

  
Dropping
MD5 92b2f2faef17969f8a7bbbbb3f1aa9fa
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 935e06731d9b88fcf33673ae11c9f9d184610aa64a6b7e1da89b1328a34e1b83

Comments