MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bfd7dca26413c18a37c6b072cd956aa998324d1fcd4d017857b853ff4557570e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bfd7dca26413c18a37c6b072cd956aa998324d1fcd4d017857b853ff4557570e
SHA3-384 hash: 17aa6a6b5d603c276f9034e53436da00703e1956551ec76e7d6764f56ffc9818772c48ead54b42baf5b6449e127bd5d2
SHA1 hash: acf982507203ed72d1c87cf9bea55bc397c7e0f4
MD5 hash: 63ac89375763371b022cded1d362ee30
humanhash: colorado-oscar-alabama-arizona
File name:29-6-2020pdf.rar
Download: download sample
Signature Loki
Create hunting rule
File size:304'976 bytes
First seen:2020-06-29 11:50:09 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:SDK9gnNCOS0xaWZOI4903q+t1FybG70aZTuW371c0f:CdnNCOS0xZAP03qWFyi4aZSEBcK
TLSH 4C5423430CBF69E39654CB0ECF6188D15C0A23B24DE5A5EAE8D30C5DA35F5853D513B5
Reporter abuse_ch
Tags:geo GRC Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.focusonweb.gr
Sending IP: 91.121.70.109
From: Αριστοτέλειο Πανεπιστήμιο Θεσσαλονίκης <webmaster@auth.gr>
Subject: ΑΙΤΗΣΗ ΓΙΑ ΠΡΟΣΦΟΡΑ (Αριστοτέλειο Πανεπιστήμιο Θεσσαλονίκης) EUI894/BU4633
Attachment: 29-6-2020pdf.rar (contains "yourcrypted_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bfd7dca26413c18a37c6b072cd956aa998324d1fcd4d017857b853ff4557570e/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 11:52:06 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x7l5zitecpayun6gwbzm3flkvgmdeti7zvgqc6cxxbj76rkxk4ha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar bfd7dca26413c18a37c6b072cd956aa998324d1fcd4d017857b853ff4557570e

(this sample)

Loki

Executable exe c351b2e2b11fb6f10ed7cc247a96ab7be144fbfe1687a04bbacf47e212342dba

  
Dropping
MD5 6a357d4bbd7937a1b8d0dc8f04af2d7a
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c351b2e2b11fb6f10ed7cc247a96ab7be144fbfe1687a04bbacf47e212342dba

Comments