MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 920d9d061f02bb2ee154c5e547c8faa6559b78b3cf7451bb6a9cceb4b88210d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 920d9d061f02bb2ee154c5e547c8faa6559b78b3cf7451bb6a9cceb4b88210d7
SHA3-384 hash: 2e678f24b89236efc79c3ba4fd7d72c8bd41b334e3354785946989beae1e753a9a6121d56b362fec00c8a681ad47b1fb
SHA1 hash: adca974a6220becbbdcbe15d667104ca078ed230
MD5 hash: 970d85b055bbaaebe8f01643681b9660
humanhash: mirror-fish-glucose-kilo
File name:PO HKG-FAI-2020-245-1 -DOC.gz
Download: download sample
Signature Loki
Create hunting rule
File size:230'678 bytes
First seen:2020-08-19 06:55:15 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:LJyXPYcxKdLLBukbI0vzee9JMQgXJhlXgHl1H8fHMaR6JZdqf8+dtI2xMeF779/k:UrxKdfBuIbqV7OH8itqfXvM07W
TLSH DD342341313B4E7567E1FD1174D6977F470D6ACA16C8B30C13BAA8C6A098E273609B8F
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.waterpistle.pw
Sending IP: 155.94.211.85
From: HKG - Christine YIU <yiucs@angloeastern.com>
Reply-To: yiucs@angloeastern.com
Subject: ORDER CONFIRM- 20/032 // PO# HKG-FAI-2020-245-1
Attachment: PO HKG-FAI-2020-245-1 -DOC.gz (contains "PO HKG-FAI-2020-245-1 -DOC.exe")

Loki C2:
http://sieqwarteg.com/kakka/kaka3/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.405.21183.14044.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/920d9d061f02bb2ee154c5e547c8faa6559b78b3cf7451bb6a9cceb4b88210d7/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 13:14:22 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sigz2bq7ak5s5ykuyxsupsh2uzkzw6ftz52fdo3ktthljoeccdlq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/920d9d061f02bb2ee154c5e547c8faa6559b78b3cf7451bb6a9cceb4b88210d7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 920d9d061f02bb2ee154c5e547c8faa6559b78b3cf7451bb6a9cceb4b88210d7

(this sample)

Loki

Executable exe 9fb0fb44cccb8d41e5d39a3a933c914edf76b6a78001521a3a22f40596fa8517

  
Dropping
MD5 9b6a49a063895f4773ff42ecadfec03f
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9fb0fb44cccb8d41e5d39a3a933c914edf76b6a78001521a3a22f40596fa8517

Comments