MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5622eb8b165f756d670360b5b79ccdb90a2525ab78bb42debcdc5e323fa51820. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5622eb8b165f756d670360b5b79ccdb90a2525ab78bb42debcdc5e323fa51820
SHA3-384 hash: 65b81c08b08db837f9a0fff17688739af8e5484e83c5c875ae33c5558ea70f810eee662ebe4ed3ae2849235395f28081
SHA1 hash: 1a529361b734138d13aa0c0c956fa581e33cb011
MD5 hash: cae4cbc7cbbe76b43deefb15353a0d72
humanhash: finch-video-zebra-pennsylvania
File name:要求報價 28-08-2020·pdf.zip
Download: download sample
Signature Loki
Create hunting rule
File size:405'988 bytes
First seen:2020-08-28 05:52:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:aWD6dV62s+nnaj/2cvMidT6T3EtFPqV+UP7UYHh1C9cr:v+HWmnaDvEdT3EtFPTUDRPr
TLSH 648423EEC16C749A07D856CDFCF4DE6E91A16AF3E1F880AE94C31780AB3B716049D512
Reporter abuse_ch
Tags:CHN geo Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.kultura.by
Sending IP: 93.125.22.95
From: 大學 臺灣 大學 <admin@ntu.edu.tw>
Subject: 要求報價 (National Tsing Hua University) ASI894/TW4006
Attachment: 要求報價 28-08-2020·pdf.zip (contains "要求報價 28-08-2020·pdf.exe")

Loki C2:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5622eb8b165f756d670360b5b79ccdb90a2525ab78bb42debcdc5e323fa51820/
Threat name:
Win32.Trojan.DelfInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-28 05:54:09 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kyroxcywl52w2zydmc23phgnxefckjnlpc5ufxv43rpdep5fdaqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5622eb8b165f756d670360b5b79ccdb90a2525ab78bb42debcdc5e323fa51820

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 5622eb8b165f756d670360b5b79ccdb90a2525ab78bb42debcdc5e323fa51820

(this sample)

Loki

Executable exe 9dfa642e04ae8353809e2d95c5f0c9d28f9bfcaacc2cc0bcce4327b0656c78fe

  
Dropping
MD5 bcc8536baa55881bb62271e063e406c4
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9dfa642e04ae8353809e2d95c5f0c9d28f9bfcaacc2cc0bcce4327b0656c78fe

Comments