MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2303046db2076537a5392211fe49a81245c9da711df11bda1602f6dea49297f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2303046db2076537a5392211fe49a81245c9da711df11bda1602f6dea49297f9
SHA3-384 hash: 7d1a5db482cd10159aa690428316b515e2133d8c0387401a2dde78e931d0bf475719241139f8b3c93ba085acf165c274
SHA1 hash: d10cceb1d9d9b48ed8cda4b5d2231a4035b2ecb7
MD5 hash: 5c9a8cc0b45cae0518142326e8f6bb7c
humanhash: pennsylvania-ohio-artist-indigo
File name:recibo_de_copia_de_pago9884038.img
Download: download sample
Signature Loki
Create hunting rule
File size:348'160 bytes
First seen:2020-07-07 06:07:16 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:2PCganN5MDDdHoFq7Hga/d+FA5CLn6YxZyoyIs15DGxtnqd69VGzG:EanPMFoF0ASMS5on/wSKDGjqd69kz
TLSH 477412517782C8EAE9A246B106F67B03EFAE4E1956555B87F78CBF0D3377842880F241
Reporter abuse_ch
Tags:img Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: cerealessevilla.com
Sending IP: 5.101.151.11
From: Alejandra Llaguerri <wholesale@maibo.com.hk>
Reply-To: info@dennisbearman.com
Subject: Re: recibo de pago
Attachment: recibo_de_copia_de_pago9884038.img (contains "recibo_de_copia_de_pago9884038.exe")

Loki C2:
http://modevin.ga/~zadmin/lmark/frega3/mode.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

SecuriteInfo.com.Artemis162931E90DCF.4593.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2303046db2076537a5392211fe49a81245c9da711df11bda1602f6dea49297f9/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 16:33:19 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=embqi3nsa5stpjjzeii74snicjc4twtrdxyrxwqwal3n5jess74q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

img 2303046db2076537a5392211fe49a81245c9da711df11bda1602f6dea49297f9

(this sample)

Loki

Executable exe 4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c

  
Dropping
MD5 b64bad63393a769438902dcbbf5e5ced
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c

Comments