MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cdefa398b6904ff2c35fd7fb8c5c5cd704bd3f8ac74c12d99b92ec5fc21030bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cdefa398b6904ff2c35fd7fb8c5c5cd704bd3f8ac74c12d99b92ec5fc21030bd
SHA3-384 hash: 2e6c74e489b4254d112d5aeeda4e4fd37d4b88ddaa4519edbdc13dd189fe31286afb552034595f6d4d1be1889f108bc6
SHA1 hash: c835d0f010db19a364954a4ac21fdef288f90ac4
MD5 hash: b7fd1790f3f900dc9bfac04b0de4f012
humanhash: mango-venus-four-uncle
File name:file
Download: download sample
Signature Loki
Create hunting rule
File size:314'181 bytes
First seen:2020-05-20 11:50:19 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:5E07e5Yf8PEB/bywfrDg4Eg1/sSLTP6MFZAfGLmjvdgf8:G07isQEBDfrlsk6MFZAkj8
TLSH F46423A017B9D366ABF5B58F3AB68F43F29F864C85659DC108042A9027733FB6CD2315
Reporter abuse_ch
Tags:file geo GRC Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail001.datapar.com
Sending IP: 170.238.19.37
From: FOOD EXPO GREECE <sale@forumsa.gr>
Subject: ΕΠΙΣΤΡΟΦΗ ΤΕΛΩΝ ΕΚΘΕΣΕΩΝ FOOD EXPO 2020
Attachment: file (contains "file.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 12:36:20 UTC
File Type:
Binary (Archive)
Extracted files:
275
AV detection:
17 of 30 (56.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zxx2hgfwsbh7fq27275yyxc424cl2p4ky5gbfwm3slwf7qqqgc6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar cdefa398b6904ff2c35fd7fb8c5c5cd704bd3f8ac74c12d99b92ec5fc21030bd

(this sample)

Loki

Executable exe 8a04b41b1321999087985915c3d8ae3dadab72bb38c66fdcac918ba98559a03f

  
Dropping
MD5 7e3eb04d88be1e677b38fc0444b6cd9f
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8a04b41b1321999087985915c3d8ae3dadab72bb38c66fdcac918ba98559a03f

Comments