MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb28ab8b53debe600b3abf814c8577903ef824a634ffc6c8af9462647404de47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb28ab8b53debe600b3abf814c8577903ef824a634ffc6c8af9462647404de47
SHA3-384 hash: 3e01b6d6e260688d4f528a047418589b41ae393b102b7194211a3afb05c10426bfed91314057005e63b2a25799285450
SHA1 hash: 93e19df3bcc90b38987bbfa68c9e96d9121b8e4d
MD5 hash: 3a94c5f9c853be1d832ab6ca655bde01
humanhash: timing-carolina-maine-steak
File name:Scan00678.gz
Download: download sample
Signature Loki
Create hunting rule
File size:57'852 bytes
First seen:2020-05-19 05:57:56 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 1536:7zcriH3YVkt8jY9FTgWrB4exfYuWjUBtyjGz0F8:7zcmmkt8jaTBrKexf1X7m8
TLSH E0430252D129B0111A43EA20DFCBAE1BA4E2CDF7F944E5E57E2C5B8CCEB64780119173
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: srv.amazondistributors.com
Sending IP: 49.50.100.74
From: Shipping Agency <accounts@ssagency.net>
Reply-To: accounts@ssagency.net
Subject: CODE ST649AMSS
Attachment: Scan00678.gz (contains "Scan00678.bat")

Loki C2:
http://adkmeritime.com/xo/yes.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Suspicious
First seen:
2020-05-19 01:48:59 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
4 of 47 (8.51%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xmukxc2t327gacz2x6auzblxsa7pqjfggt74nsfpsrrgi5ae3zdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz bb28ab8b53debe600b3abf814c8577903ef824a634ffc6c8af9462647404de47

(this sample)

Loki

Executable exe c3b88b1d9c86a4f7cb1ae7c8b91d44d67c9c9e66ea51504c3204eb575a668fea

  
Dropping
MD5 fcabd32842ae0009315bb57ffc372786
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c3b88b1d9c86a4f7cb1ae7c8b91d44d67c9c9e66ea51504c3204eb575a668fea

Comments