MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c00e37efc6879d9831b58882abfedec59c996dbf3ad26067014ce02861091d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 4 Yara Comments

SHA256 hash: 9c00e37efc6879d9831b58882abfedec59c996dbf3ad26067014ce02861091d9
SHA3-384 hash: eefc067656bcb4d9f933ff6769aebabf7f43f828f3846f92bc86977fcb4744b45f0073c268c6829b17f6b505480539d5
SHA1 hash: 4aae913f8001c27d67336590cefda48d3f07de57
MD5 hash: 949121a6e1c016af572afd832c2e75de
humanhash: double-tennis-oklahoma-lamp
File name:SOR Price 062820KATARA PROJECT - MECH SOR Tender.zip
Download: download sample
Signature Loki
File size:349'630 bytes
First seen:2020-06-30 06:29:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:k8Ey7wbW/vUykjCNvyazo1MyQFv4ZEVM1hlZAkla0gD6buURHOdvUSmd:r7wpCVyD/6kHhTHgD6bVR6m
TLSH 2F7423D7E2DB4E4B0C52D8664F02100E669770CF661E95DB3B0A6CEB806B8E4D4ED31B
Reporter @abuse_ch
Tags:Loki zip


Twitter
@abuse_ch
Malspam distributing Loki:

HELO: web26.3essentials.com
Sending IP: 50.59.99.101
From: Patrick <support4@islkenya.com>
Reply-To: support4@islkenya.com
Subject: KATARA PROJECT - MECH SOR (Tender)
Attachment: SOR Price 062820KATARA PROJECT - MECH SOR Tender.zip (contains "SOR Price 062820KATARA PROJECT - MECH SOR (Tender).exe")

Intelligence


Mail intelligence
Trap location Impact
Global Medium
# of uploads 1
# of downloads 30
Origin country FR FR
ClamAV PUA.Win.Adware.Slugin-6803969-0
PUA.Win.Adware.Slugin-6840354-0
CERT.PL MWDB Detection:n/a
Link: https://mwdb.cert.pl/sample/9c00e37efc6879d9831b58882abfedec59c996dbf3ad26067014ce02861091d9/
ReversingLabs :Status:Malicious
Threat name:Win32.Trojan.Injector
First seen:2020-06-30 06:31:05 UTC
AV detection:28 of 48 (58.33%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
VirusTotal:Virustotal results 45.31%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 9c00e37efc6879d9831b58882abfedec59c996dbf3ad26067014ce02861091d9

(this sample)

  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment

Comments