MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4353969cf549e5d4ed98ae42956a7328f09ce2ee61afe1eb6a7d6f8044b18d84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4353969cf549e5d4ed98ae42956a7328f09ce2ee61afe1eb6a7d6f8044b18d84
SHA3-384 hash: 93c2c58875c21c540c633c67d091656562e4fbef808438364a3f889cb3d2e302ac513cfc02b4b2085ace2264086096f5
SHA1 hash: be5f33da85d878d21a407c8e579c44ca7630a174
MD5 hash: 6da774aba7d7dc363520a6f504579347
humanhash: nebraska-eleven-one-alpha
File name:Docs-scan191055_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:382'720 bytes
First seen:2020-05-27 08:02:34 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:wT9RAEldSJUHHSPBI6vigVIFgF50aNp0VBQ4cJIj7ek6vLANv0DTdHgV4jbNmTnw:wTHrlAJUSPrqgKpK2EJIj7eksLANvUp7
TLSH FB84236BCFC860284F2E799690BF5D1CB367E2E4C6AFD3174A10971A85C2358CCD5A87
Reporter abuse_ch
Tags:gz Loki Maersk


Avatar
abuse_ch
Malspam distributing Loki:

HELO: 125-web12.theserversystem.net
Sending IP: 67.222.145.125
From: Maersk Global Ltd <msc.vnsgn@msc.com>
Subject: Maersk Overdue Account Notice BK 339IN2012691
Attachment: Docs-scan191055_pdf.gz (contains "Docs-scan191055_pdf.exe")

Loki C2:
http://intco.tk/L5/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Win32.Herz.B.8644.32604.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 09:05:24 UTC
File Type:
Binary (Archive)
Extracted files:
266
AV detection:
22 of 31 (70.97%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 4353969cf549e5d4ed98ae42956a7328f09ce2ee61afe1eb6a7d6f8044b18d84

(this sample)

Loki

Executable exe c73486be1c49041a9a3f8510a23e3a021c97cbe727170f3ddb19361dcb84ecef

  
Dropping
MD5 748eb45ffc897eb25867699f0d8a95a8
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c73486be1c49041a9a3f8510a23e3a021c97cbe727170f3ddb19361dcb84ecef

Comments