MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed3eed1436741ef3c97b06ff95e570b5d71b35f0ec981dead41bc058fad284bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed3eed1436741ef3c97b06ff95e570b5d71b35f0ec981dead41bc058fad284bb
SHA3-384 hash: b95064ab6f46dce594e78eeb166915b9ae8ffb01737031a341a5a2773ae3fda90680757d51de746853784d07cdcfb066
SHA1 hash: 063f6aa68151a0a3eeb0351956ae87bb863b50a0
MD5 hash: 06b9f948728f5a3d807cac118bc3180b
humanhash: maryland-zebra-mike-equal
File name:Formulario de distribucion gratuita·pdf.zip
Download: download sample
Signature Loki
Create hunting rule
File size:391'458 bytes
First seen:2020-07-06 15:10:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:mAd4A0K4yzc4aR4A3aNI8Jaqv8CSBntWOwGZ/bcnyGt0sUnAy/jaAhazyiabdtrk:94A0FygNR5alJaqHSdt17wAloJI0
TLSH 5A842389663EFFEED41BD44B9BD5A0A0E0830A9047E869DDB4270ED6D24D3663A5C84C
Reporter abuse_ch
Tags:geo Loki PER zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: stella.raybear.com
Sending IP: 213.239.211.25
From: Ministerio De Salud, Perú <covid-19@gob.pe>
Reply-To: covid-19@gob.pe
Subject: Distribución gratuita de equipos de protección covid-19 (Ministerio De Salud, Perú)
Attachment: Formulario de distribucion gratuita·pdf.zip (contains "Formulario de distribucion gratuita·pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Daqc-6598201-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ed3eed1436741ef3c97b06ff95e570b5d71b35f0ec981dead41bc058fad284bb/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 15:12:06 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5u7o2fbwoqpphsl3a37zlzlqwxlrwnpq5smb32wudpafr6wsqs5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip ed3eed1436741ef3c97b06ff95e570b5d71b35f0ec981dead41bc058fad284bb

(this sample)

Loki

Executable exe 99d0bf4a7f804a84e2bbb8cc965fcb6256113d32f1819ba9cb32a4269d6a3d20

  
Dropping
MD5 fc5cb2c1d756b429559a3371ae95fc6f
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 99d0bf4a7f804a84e2bbb8cc965fcb6256113d32f1819ba9cb32a4269d6a3d20

Comments