MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 296da6c6402442d49cfd43e9f9f643390ca2dc9f7430891d5fbbd49294d94d85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 296da6c6402442d49cfd43e9f9f643390ca2dc9f7430891d5fbbd49294d94d85
SHA3-384 hash: 3c799c68857be39941a13f3e3f8d90683b0c858762f6649153178365d77c1bfff3f953ab3d894bbec3f2b7af50f578c8
SHA1 hash: 5efced26a03dd507d200adcda2d3321c39af5db9
MD5 hash: a00557da80ec852a2247f08e2e52a0bc
humanhash: summer-sad-eleven-coffee
File name:Scanned-PO.gz
Download: download sample
Signature Loki
Create hunting rule
File size:23'057 bytes
First seen:2020-05-14 06:01:25 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 384:ZBZYM/Ssf3ACaagDVc1W/4y0UJjCml5O5XDEASy1qUW4VpbiARq5Fe5ebyQcV5:ZY1sfRgDVc1ERJWXg1mWiAAs5G/15
TLSH 20A2C087D40A44B6D07F9E2BA2F016DCA0752987BFF9C50B83719CB1F2EAC14E11550B
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: vm-holz.at
Sending IP: 142.11.196.197
From: Vöcklamarkter Holzindustrie GmbH <Sabrina.Brand@vm-holz.at>
Reply-To: noreply@domain-admin.com
Subject: RE: Please_Find_Here_Attached//P.O
Attachment: Scanned-PO.gz (contains "precept.scr")

Loki C2:
http://spln4.com/oo/yoyo.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 06:36:58 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ffw2nrsaerbnjhh5ipu7t5sdhegkfxe7oqyishk7xpkjffgzjwcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 296da6c6402442d49cfd43e9f9f643390ca2dc9f7430891d5fbbd49294d94d85

(this sample)

Loki

Executable exe 08361399bcfd6c87b301f7dd61be86d5eedf3013608d3cd98c818435bd43a724

  
Dropping
MD5 36f2929edc1f6ad027a19baf60880ac3
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 08361399bcfd6c87b301f7dd61be86d5eedf3013608d3cd98c818435bd43a724

Comments