MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41c2f90936b34924eb72998db1f19590441fb9521caec872fdf96d4f56b81359. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41c2f90936b34924eb72998db1f19590441fb9521caec872fdf96d4f56b81359
SHA3-384 hash: 2fe969cc4bb7ff2ae8a91d1e9cd06f7e0528bac7cdbda5f8cb4d73891d6bec44c41a43b9c62d5f955739a16bcd850866
SHA1 hash: 30e8c4a3c864390169e740c35b92019edb197810
MD5 hash: c94d65d6a9d86a83f492b464384387fc
humanhash: nine-six-red-mango
File name:TF1708291.zip
Download: download sample
Signature Loki
Create hunting rule
File size:983'196 bytes
First seen:2020-08-18 13:08:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:GmWWuTOOiP3pI8uS5E+MoRoq4rAok93Ew6c4OQLX4:Gmis5INS5Eit4rAR9376c4FL4
TLSH 0A25330405DA5CA707B98C7E6A925FCC7687F76B24CDC58D4211821CDB3639DA2EBE2C
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: medianis.net
Sending IP: 185.96.211.121
From: Tiger Valve Company <purchase@tigervalves.com>
Subject: PO.TGF291
Attachment: TF1708291.zip (contains "TF1708291.exe")

Loki C2:
http://japosinks.duckdns.org/collates/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
51
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41c2f90936b34924eb72998db1f19590441fb9521caec872fdf96d4f56b81359/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 13:10:06 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ihbpscjwwnesj23stgg3d4mvsbcb7oksdsxmq4x57fwu6vvycnmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/41c2f90936b34924eb72998db1f19590441fb9521caec872fdf96d4f56b81359

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 41c2f90936b34924eb72998db1f19590441fb9521caec872fdf96d4f56b81359

(this sample)

Loki

Executable exe 9bb1a92bc0f71772f7a57b22fa9a62b2147243d9c1387cf5767d7dea516c37ca

  
Dropping
MD5 d305eeaa9cf297eceb16c018fdc6b4e7
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9bb1a92bc0f71772f7a57b22fa9a62b2147243d9c1387cf5767d7dea516c37ca

Comments