MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d832d58a65c7d6c949df87a1954aca382894addedd6bee32cd5c04f416e2216f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d832d58a65c7d6c949df87a1954aca382894addedd6bee32cd5c04f416e2216f
SHA3-384 hash: 1566869a4f3f0b1a79a74febda3ce356e910a941cf487314bd4cddb5b4d4968a7374ae1741114e9c47b812771e8f21f1
SHA1 hash: d532ad25c17a8457ee556419fc3853cbf3ee4391
MD5 hash: 291edd292c17799fae98b0fe24bc688a
humanhash: arizona-nitrogen-orange-tennessee
File name:pcm89335.zip
Download: download sample
Signature Loki
Create hunting rule
File size:649'717 bytes
First seen:2020-08-31 05:41:11 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:I8NW8/P4jNbilT4gnDyvfiDkT92+l80/4YlcnkROYct30XXuYq2Pc/8SY8+vG4uZ:ImWWuTOOH1T92e80wYlcnguEauc/8Spb
TLSH 9ED4233299273D77B2A0DCB329F0ACCC1A479F99289508C1D502B5C9B9733FE17906A3
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: m26.hostmatrix.biz
Sending IP: 103.143.173.26
From: ADM Trading Ltd <purchase@adm.com>
Subject: Purchase Order.
Attachment: pcm89335.zip (contains "pcm89335.exe")

Loki C2:
http://japosinks.duckdns.org/collates/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d832d58a65c7d6c949df87a1954aca382894addedd6bee32cd5c04f416e2216f/
Threat name:
Win32.Trojan.NetWired
Create hunting rule
Status:
Malicious
First seen:
2020-08-30 23:06:03 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3aznlctfy7lmsso7q6qzkswkhaujjlo63vv64mwnlqcpifxcefxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
netwire
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d832d58a65c7d6c949df87a1954aca382894addedd6bee32cd5c04f416e2216f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip d832d58a65c7d6c949df87a1954aca382894addedd6bee32cd5c04f416e2216f

(this sample)

Loki

Executable exe 15a5acf7f504d480ae0925b9f4f9e18b7a75f371d3afd1d1bc59ed30abaca08b

  
Dropping
MD5 21a8dbfe9d4838730a2925862ee645c9
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 15a5acf7f504d480ae0925b9f4f9e18b7a75f371d3afd1d1bc59ed30abaca08b

Comments