MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 42ee3079ec151faa2654e48b0abd44bb6fe5b554f584062b74f40af4957c6516. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 42ee3079ec151faa2654e48b0abd44bb6fe5b554f584062b74f40af4957c6516
SHA3-384 hash: 67e8c9c59d84ad1e1e30ec96ffc590183bae8fc8fa235bb04b02ad99d26f0e54772fb33ec5be8ceda20786834dd72af6
SHA1 hash: ba16956a822692057f2a93f7cb17bbb6c6ff9d8a
MD5 hash: e8f8b30782d95cc755829ddf37f7db1e
humanhash: oven-golf-earth-two
File name:RFQ Docs AmassFreight_117610.gz
Download: download sample
Signature Loki
Create hunting rule
File size:373'723 bytes
First seen:2020-05-04 20:42:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:t081Ue6uiAzWxdzq6MfuLXd0Z51o0gyHdX0LQo/DBk8vW4Dfpe/+A7S4X4:WyUepcxJyupKWOmco9P/9e/+ml4
TLSH 1A842313FDC32E80134A5AF382D991DF11C925CABB127DDBDF1BA01501A32966EB2CD6
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server.infonet.com.vn
Sending IP: 162.214.15.103
From: Ms. Hà Thị Phương Thảo <Cs03@vietsungloal.com>
Subject: PAYMENT INVOICES 8001657111-28001657112
Attachment: RFQ Docs AmassFreight_117610.gz (contains "INV-117610.exe")

Loki C2:
http://rnarport.com/drunk/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 22:22:00 UTC
File Type:
Binary (Archive)
Extracted files:
61
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ilxda6pmcup2ujsu4sfqvpkexnx6lnku6wcamk3u6qfpjfl4mula._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 42ee3079ec151faa2654e48b0abd44bb6fe5b554f584062b74f40af4957c6516

(this sample)

Loki

Executable exe ce300fe22dd40237e443695aa13c19735e359100883aef58ac05cb7f127cf604

  
Dropping
MD5 ff5e107aa8911c2b504e74d1ab236109
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ce300fe22dd40237e443695aa13c19735e359100883aef58ac05cb7f127cf604

Comments