MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9fe9961b00631d2c81b225772ff437e6cf6e8f8706f3173eac38037793f6c295. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9fe9961b00631d2c81b225772ff437e6cf6e8f8706f3173eac38037793f6c295
SHA3-384 hash: fbfb5888b9faa8f7a0e1d7d4ceb58e6d81842780aa00fe3f6ca3d187a0e056d348e6024698aeb8712f69bd9f4c41e026
SHA1 hash: ef4ebf59f6cbd6c0c16a39bfee05d2895b3237c7
MD5 hash: 8885a81244c9f8dbe8529e5898ce4747
humanhash: oven-johnny-lake-spring
File name:Encomenda_TR-088399_AG.zip
Download: download sample
Signature Loki
Create hunting rule
File size:1'117'631 bytes
First seen:2020-05-20 08:28:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:Pp0KRSuRKTGPk1kPTacOCQxIEIyArlMb0UBCtod6I:PRgTGmxdEyAibwXI
TLSH 9C35330E560F9D91DDD33D2EA5919934A49EE22BBBF4221DF93400A4CD2B83505F5ECE
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.llkc.lv
Sending IP: 80.232.172.84
From: Armando Melo <m.armando@multifluido.com>
Subject: R: Encomenda_TR-088399AG
Attachment: Encomenda_TR-088399_AG.zip (contains "Encomenda_TR-088399_AG.exe")

Loki C2:
http://ipcastro.co/P1/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 08:36:50 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t7uzmgyammoszansev3s75bx43hw5d4ha3zropvmhabxpe7wykkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 9fe9961b00631d2c81b225772ff437e6cf6e8f8706f3173eac38037793f6c295

(this sample)

Loki

Executable exe 6074f33a64f0aabe0ffcfd4478dd76025eb5329955c7ae8ae8dec35390939548

  
Dropping
MD5 48482d2b7bf293fa6961252b119d2cbd
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6074f33a64f0aabe0ffcfd4478dd76025eb5329955c7ae8ae8dec35390939548

Comments