MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56f72fd8913b4d8e21663dee4a2b1ec242b875b9e185ace9cce522bfbb60e422. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56f72fd8913b4d8e21663dee4a2b1ec242b875b9e185ace9cce522bfbb60e422
SHA3-384 hash: 510321219d6784547f22faef09ea1fd89ef2aa17ffd14b2e18aedae542de555569191269c6f767b36a069c46368edf0b
SHA1 hash: 68d453385a21d4bc620e5f0c55d6256005a18892
MD5 hash: 2f6bcfeb9f75a972aa8d03cfc82cce30
humanhash: enemy-cold-blossom-oven
File name:RFQ40631.zip
Download: download sample
Signature Loki
Create hunting rule
File size:415'285 bytes
First seen:2020-05-05 09:26:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:6ukMrQIiinbhqxwEK48rn72bjH4tEs/bEqTzQqi8BxmHIx2Fhd+ulB6wS6D/S:BkMsV+bMJTFQAyfio8H37RB6wS6+
TLSH 4F942390607D4B6E7AD3EF15D7FC9E57B28FC1C20E68A01162A32724C4FA96057BC46E
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: host1105.infoser.net
Sending IP: 37.153.90.190
From: Georgios Michos <m.george@immsupplies.com>
Subject: RE: Νέα παραaγγελία / αίτηaμα_RFQ40631
Attachment: RFQ40631.zip (contains "RFQ40631.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Remcos-7759529-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 09:35:28 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k33s7werhngy4ilghxxeuky6yjblq5nz4gc2z2om4url7o3a4qra._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 56f72fd8913b4d8e21663dee4a2b1ec242b875b9e185ace9cce522bfbb60e422

(this sample)

Loki

Executable exe 3368363263766bc139e690192523a2a2d585c137b3b9d6230e06a590c1ba7753

  
Dropping
MD5 3604c94317e50567f1bee2a3d06d2c48
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3368363263766bc139e690192523a2a2d585c137b3b9d6230e06a590c1ba7753

Comments