MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 530da3aa6ccf9fe6fe04a413ab668aa240c0239a28701bafad0c05a6b38a479b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 530da3aa6ccf9fe6fe04a413ab668aa240c0239a28701bafad0c05a6b38a479b
SHA3-384 hash: 806888ccf47187dc8f8b4c1d4be83a72b65955666268be1e4057fab26a34ae3b99193324f89a83a7234597b9e556a587
SHA1 hash: 47ff23f047307851cc2e9128bde360c2ceda984b
MD5 hash: f513656edc0baba1be8798605fe90d64
humanhash: mississippi-oscar-stream-uniform
File name:KOU Order list Images_pdf.zip
Download: download sample
Signature Loki
Create hunting rule
File size:448'166 bytes
First seen:2020-08-07 13:27:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:YzD2XToerX1GJros9c9Dl5QjbBnSQ012F9gBkJGEV:Tc2srd+rQjbBnx0189MkcEV
TLSH DA9423752C4A327FD6ED03434C58E4B9A08C57DFE54E067ED144C9A7C3A21B26B39A2B
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.facetohen.ml
Sending IP: 5.8.93.170
From: Mark Anthony <candy@facetohen.ml>
Subject: FW: MARK T. SOLLANO ORDER INQUIRY
Attachment: KOU Order list Images_pdf.zip (contains "KOU Order list & Images_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/530da3aa6ccf9fe6fe04a413ab668aa240c0239a28701bafad0c05a6b38a479b/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2020-08-07 13:29:06 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kmg2hktmz6p6n7qeuqj2wzukujamai42fbybxl5nbqc2nm4ki6nq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/530da3aa6ccf9fe6fe04a413ab668aa240c0239a28701bafad0c05a6b38a479b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 530da3aa6ccf9fe6fe04a413ab668aa240c0239a28701bafad0c05a6b38a479b

(this sample)

Loki

Executable exe 1467c56bab773ed3ca2cbfbbdd1334bd41a8303e2261112cbab3fc37c518f5dd

  
Dropping
MD5 32c22a6129ec107e3c829c77a819f167
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1467c56bab773ed3ca2cbfbbdd1334bd41a8303e2261112cbab3fc37c518f5dd

Comments