MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ade4edf35f148a57d05e7621f95c901099bac56c0ad539b0c0cb77977f63ac2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ade4edf35f148a57d05e7621f95c901099bac56c0ad539b0c0cb77977f63ac2
SHA3-384 hash: 01c0473e07510cdac00137c9fb51b3fe7f9689d99287ffd21825dd37c0ff4e96a0cb34b780806c8ac3c4d4a03ba3de14
SHA1 hash: 9e6710607dc6f6ee32cbc9911a5758482bf068f3
MD5 hash: 9c3ccbd9b61c3f0ffa98c3c9315bfd44
humanhash: connecticut-salami-sodium-quiet
File name:invoice.pdf.z
Download: download sample
Signature Loki
Create hunting rule
File size:341'036 bytes
First seen:2020-06-25 13:30:17 UTC
Last seen:2020-06-25 13:30:29 UTC
File type: z
MIME type:application/x-rar
ssdeep 6144:Yj7tVg0BKlGRkJiy0kXgvcNv0EykBLAVYh+wcMLZiDyPKxEE8iLotlCYS:gJRkJIzvceEyiiK+lmmyPU3v
TLSH 4E74231E336F6BEDF63933D79A7501EA9A0A80ABE24CCE29444012E761C0CDD35BE55D
Reporter abuse_ch
Tags:Loki z


Avatar
abuse_ch
Malspam distributing Loki:

HELO: yandex.ru
Sending IP: 95.211.208.58
From: Export Department <ac.general@yandex.ru>
Subject: 答复:Urgent Request for Account
Attachment: invoice.pdf.z (contains "invoice.pdf.exe")

Loki C2:
http://reiangkor.com/uploads/images/Gallery/Panel/five/fre.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ade4edf35f148a57d05e7621f95c901099bac56c0ad539b0c0cb77977f63ac2/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 13:54:01 UTC
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jlpe5xzv6fekk7if45rb7fojaeezxlcwycwvhgymbs3xs57whlba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z 4ade4edf35f148a57d05e7621f95c901099bac56c0ad539b0c0cb77977f63ac2

(this sample)

Loki

Executable exe d068c75fa5e9db0ddc74c4bbfce6c28260b2bf7a5651073c61dac073fd249b80

  
Dropping
MD5 4490910850654ecfe35455981865ffcc
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d068c75fa5e9db0ddc74c4bbfce6c28260b2bf7a5651073c61dac073fd249b80

Comments