MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f85c0d2ff5d529e6425dc62156251b3dee221b17d1357d1a8343cccb799b195e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f85c0d2ff5d529e6425dc62156251b3dee221b17d1357d1a8343cccb799b195e
SHA3-384 hash: 8f35465b31f90cc45969aadf444bc223a72a3b0ef2992d7a4709d6f07ffc6de4a1aaf486867a69dd50026b9dddd601cb
SHA1 hash: ce41e628c3a47457dcfcea54b07d8967b386d6b3
MD5 hash: 413b66d7e6fdd37d3a34581df7a045ec
humanhash: jersey-pasta-fifteen-illinois
File name:PO COPY.pdf.z
Download: download sample
Signature Loki
Create hunting rule
File size:395'247 bytes
First seen:2020-06-24 19:56:12 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:zY7jaBNAggE6viCIEF1GFQYL5bcqYGTPX:MCQgYvBtPGRrYYPX
TLSH 368423B9399F2C357960EB8CB7000D304F65615E63B2D4E2C41278B52FAE8768F635B6
Reporter cocaman
Tags:Loki z


Avatar
cocaman
Malicious email
From: Export Department <ac.general@yandex.ru>
Received: from yandex.ru (unknown [95.211.208.58])
Date: 24 Jun 2020 17:14:14 -0700
Subject: =?UTF-8?B?562U5aSNOlVyZ2VudCBSZXF1ZXN0IGZvciBJbnZvaWNl?=
Attachment: PO COPY.pdf.z

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200625-0805.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f85c0d2ff5d529e6425dc62156251b3dee221b17d1357d1a8343cccb799b195e/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7boa2l7v2uu6mqs5yyqvmji3hxxcegyx2e2x2gudipgmw6m3dfpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z f85c0d2ff5d529e6425dc62156251b3dee221b17d1357d1a8343cccb799b195e

(this sample)

Loki

Executable exe d2dc5299f64dc02a7e375d91f73145c7eb88a0a1155a21f4c7f4a4e07c5117b4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d2dc5299f64dc02a7e375d91f73145c7eb88a0a1155a21f4c7f4a4e07c5117b4

Comments