MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b4dc7e6bc2b1cd501dfdc363ff0f0580b2a4c980aae5f3bfea8a7516128efe8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b4dc7e6bc2b1cd501dfdc363ff0f0580b2a4c980aae5f3bfea8a7516128efe8
SHA3-384 hash: 6e1b4ba418a9f22779749a9373bda3a0dd889cc152844460af10d8bd39f833a65a4901d8a21ea70ba5a65b8bfe865ca3
SHA1 hash: 56134a385381905e8e5c2f686632def7847b27c8
MD5 hash: bd24b143473a16c727c2d1df758f6e2e
humanhash: river-georgia-double-video
File name:Order List Madinilift 20200806_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:255'854 bytes
First seen:2020-08-06 06:09:14 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:kMuleaipyv8798Ha/LMVdMZDDtxHyjxLPTGXw0UMgv/kbX8vY5B:kdlPi17mq6kDfiawigUAc
TLSH 8844230CCD5ED4D38BC3CB9894FDC17369CA921F5C20AD9646CBADF4C89A5A409E88D9
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.ptjlg.co.id
Sending IP: 103.253.68.52
From: Marković Kovačević <sales.support@ptjlg.co.id>
Reply-To: celina@madinilift.com
Subject: Order Inquiry
Attachment: Order List Madinilift 20200806_pdf.gz (contains "Order List Madinilift 20200806_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8b4dc7e6bc2b1cd501dfdc363ff0f0580b2a4c980aae5f3bfea8a7516128efe8/
Threat name:
Win32.Trojan.MassLogger
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 02:59:41 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rng4pzv4fmonkao73q3d74hqlafsuteybkxf6o76vctvcyji57ua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8b4dc7e6bc2b1cd501dfdc363ff0f0580b2a4c980aae5f3bfea8a7516128efe8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 8b4dc7e6bc2b1cd501dfdc363ff0f0580b2a4c980aae5f3bfea8a7516128efe8

(this sample)

Loki

Executable exe ed08a1f65980d0f24e174be95df0c9b1bbb05703a7f267315ab34d02d46efaed

  
Dropping
MD5 452302fb31262ab7a11495730f811dcd
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ed08a1f65980d0f24e174be95df0c9b1bbb05703a7f267315ab34d02d46efaed

Comments