MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8c35befe25bc418e466e78cb9df07bc0d5accd8ac6bfb12a80f738d76f8eaa0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8c35befe25bc418e466e78cb9df07bc0d5accd8ac6bfb12a80f738d76f8eaa0
SHA3-384 hash: a5fa66dfe7e2d03635f8c516446d611f716f5a1650c4515a6178feb463d819a7f5f2d93519f3b8f97696f4628a6e20af
SHA1 hash: 97d0a053c221bf392f05a2326beb68fdebb61f5d
MD5 hash: 4acc29ab46e5b87c8995c0dddb172606
humanhash: robert-don-july-nitrogen
File name:IAN CORPORATION PO_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:354'908 bytes
First seen:2020-05-19 05:36:55 UTC
Last seen:2020-05-19 13:02:53 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:o7lAYKauNnJfOaWYaoYAMh7FpE1Qw/AJDFck2Xr154RJ0TX3dqq:o7CdJ2dnoYAM3wYQLR543O3dqq
TLSH 48742396CD2CD62EFB02DA95084578E776CE34911AD4FDA190C37A411FBC1EC6E8BB48
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: ianconstruction.com
Sending IP: 103.99.1.147
From: IAN CORPORATION<bids@ianconstruction.com>
Subject: RE : ORDER C0NFIRMATION REMINDER
Attachment: IAN CORPORATION PO_pdf.gz (contains "scan-410288_pdf.exe")

Loki C2:
http://broken10.cf/LO4/fre.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.BehavesLike.Win32.AdwareDealPly.bc.5405.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 19:24:00 UTC
File Type:
Binary (Archive)
Extracted files:
287
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vdbvx37clpcbrzdg46gltxyhxqgvvtgyvrv7wevib5zy25xy5kqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip a8c35befe25bc418e466e78cb9df07bc0d5accd8ac6bfb12a80f738d76f8eaa0

(this sample)

Loki

Executable exe 2f7cc36fd6e3bc0946b1846b1b24f578a92af95d8ebc4fdac81b36dbaf24daa4

  
Dropping
MD5 e52eaa938c505314a73996b172a8b3d3
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2f7cc36fd6e3bc0946b1846b1b24f578a92af95d8ebc4fdac81b36dbaf24daa4

Comments