MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ac3b8578dcfbfa083c6697ae6d114e9936dd07e8ba81112cee1b14ea9831747. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ac3b8578dcfbfa083c6697ae6d114e9936dd07e8ba81112cee1b14ea9831747
SHA3-384 hash: 2e1b63f7df82d85464669e955e06bc05506e3468407a840ff70334fcb6325c6770b96e3eefbb2efbf09590d785ac7850
SHA1 hash: 4b79dfd071daa502ecc5e206a4aea4bfea3c9edf
MD5 hash: 62fbbf10bfa82e05405d6888b53650f6
humanhash: xray-nineteen-kentucky-oxygen
File name:invoice.pdf.z
Download: download sample
Signature Loki
Create hunting rule
File size:518'484 bytes
First seen:2020-08-30 15:39:21 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:osJPzXB1kdBI5PjsvVodkfeNiE+13uGGbXo6cB6s9zTIZUTkud:hJrQdS5PymkYiR1+06cB6Bqkud
TLSH 23B42327F5B9B8D52DD416B39D78D1571E7E22F016C89A6CCA3BF4B012C6B016FE012A
Reporter abuse_ch
Tags:Loki z


Avatar
abuse_ch
Malspam distributing Loki:

HELO: sunshinespecialities.com
Sending IP: 95.211.253.201
From: Export Department<jhorvath@sunshinespecialities.com>
Subject: PO# M26804.
Attachment: invoice.pdf.z (contains "invoice.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8ac3b8578dcfbfa083c6697ae6d114e9936dd07e8ba81112cee1b14ea9831747/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-08-30 14:39:12 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rlb3qv4nz672ba6gnf5onuiu5gjw3ud6roubcewo4gyu5kmdc5dq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8ac3b8578dcfbfa083c6697ae6d114e9936dd07e8ba81112cee1b14ea9831747

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z 8ac3b8578dcfbfa083c6697ae6d114e9936dd07e8ba81112cee1b14ea9831747

(this sample)

Loki

Executable exe edb014655bf6c7464325b44856019f5fb1aedb94fe9ed988faa0c77d82875d3c

  
Dropping
MD5 44f23aeb7fa987a883a96dbe1745549f
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 edb014655bf6c7464325b44856019f5fb1aedb94fe9ed988faa0c77d82875d3c

Comments