MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7a871eabe5109e34637c1b87e93a314f8593d54c11ddca98dd80124815fda8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b7a871eabe5109e34637c1b87e93a314f8593d54c11ddca98dd80124815fda8a
SHA3-384 hash: b6c97412e0567db74e5a29cde569082a436a040b273b0fe8f254a58fe2065aaf55099e78e4c0ff5f49a53447f84ba6b4
SHA1 hash: b18f654fc9276363ba6da72f3567a5ffead43b25
MD5 hash: 3269cf96d94c54a2622c679791eb560f
humanhash: maine-gee-idaho-zebra
File name:RFQ69013026017_pdf.r00.gz
Download: download sample
Signature Loki
Create hunting rule
File size:136'552 bytes
First seen:2020-05-20 07:56:29 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 3072:TwxpD0npYmqkmKGFEFQfaYXEfG1999kmWlX53nm:cxpD8qk7QfJtLLkdS
TLSH BDD31223B081FAA5B5E4BCB3D156D68E7034FFD9A359F1D416C358BE48E14CD4A28CA4
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: eep1-15.nexcess.net
Sending IP: 104.207.230.81
From: ROKONMA (S) PTE <azlina@rokonma.com.my>
Subject: Please send me price list.
Attachment: RFQ69013026017_pdf.r00.gz (contains "RFQ69013026017_pdf.r00.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.b2fdfa0eed53c2c9.3589.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 08:36:51 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w6uhd2v6kee6grrxyg4h5e5dct4fspkuyeo5zkmn3aasjak73kfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz b7a871eabe5109e34637c1b87e93a314f8593d54c11ddca98dd80124815fda8a

(this sample)

Loki

Executable exe e0ab8e88ccd536d46709ed1434bd5f42adab436113456e48e2694b53419d4e7c

  
Dropping
MD5 b2fdfa0eed53c2c9f5c4c04f4a8227c0
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e0ab8e88ccd536d46709ed1434bd5f42adab436113456e48e2694b53419d4e7c

Comments