MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3cef3773103379e815ec1f5c1470af9ada8f252f1371a7fdf3d0c52b30f4eaf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3cef3773103379e815ec1f5c1470af9ada8f252f1371a7fdf3d0c52b30f4eaf
SHA3-384 hash: 2fb76cbbdb5c9ac23c47c898225a2961b40f5a0744e591907cd12278c7bb9b5383fc9c24fb6284a6d7f599e678d84b19
SHA1 hash: 36c4fdc905eb9667d3d7204cb69c5060f1c4c07d
MD5 hash: 1d3d5ae5f00273cc19b75aca65d37831
humanhash: batman-north-apart-triple
File name:New PO for DJ Engineering PO EA00003333-PDDF.gz
Download: download sample
Signature Loki
Create hunting rule
File size:362'787 bytes
First seen:2020-05-20 12:03:51 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:yNOA/D3JaRxu5mMR4MtxV27EDda2sdzp07TndXNpoyQMihrZAHP9W:Y/zJaG5m24AtDa907TnxNpMnrZsVW
TLSH 5D7423C6FDF38B71A9C1757AB2FB4B7076AEDE051CA71610960DFE9C2D38482A5420B1
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail0.82.igfxinvest.com
Sending IP: 68.183.88.97
From: Dawn Lord | Purchasing Agent <sctrd@live.com>
Subject: New PO for DJ Engineering PO# EA00003333
Attachment: New PO for DJ Engineering PO EA00003333-PDDF.gz (contains "New PO for DJ Engineering PO EA00003333-PDDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 12:35:42 UTC
File Type:
Binary (Archive)
Extracted files:
274
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yphpg5zram3z5ak6yh24cryk7gw2r4ss6e3ru767hugffmypj2xq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz c3cef3773103379e815ec1f5c1470af9ada8f252f1371a7fdf3d0c52b30f4eaf

(this sample)

Loki

Executable exe 963d503685bdaaaba8f23a99900beba2c959ffb71a77ec4ce71036206069b928

  
Dropping
MD5 613beddaefa4e89e9a68ae86b3677ee5
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 963d503685bdaaaba8f23a99900beba2c959ffb71a77ec4ce71036206069b928

Comments