MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe7d51310985f0bab396c9fe6e8e30ac6e338c34978ac4989fac0201534b3f87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe7d51310985f0bab396c9fe6e8e30ac6e338c34978ac4989fac0201534b3f87
SHA3-384 hash: 720a500da0a575e5daa9d42f76c7f85faa45a253b233721f1dc1523c218527ff25d0d8114a4044611c5458eba0804712
SHA1 hash: 98159ede2cf63365381688cca7fd50e5e044cfd7
MD5 hash: 3843e0b4860fc7b5941eadfa65778619
humanhash: charlie-jupiter-one-mockingbird
File name:PRE1058984.pdf_PDF_________________________________________________________546.gz
Download: download sample
Signature Loki
Create hunting rule
File size:187'241 bytes
First seen:2020-06-17 10:47:01 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 3072:6pdUg3zpycTSFDIaSYL7COwPU6RrQocoCdZG209K7TYLJtWsFw+wA7CR9G9YmF+2:6pdUg3zpy+SFDTLGOwP58ocoCbn09K7m
TLSH 6C04128365A5C81B845EF97A7253F67DC2E5E9B7E097CBCE00DB2A409921F23040CB67
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: relay2.grserver.gr
Sending IP: 185.4.132.177
From: Muhammed Zaahid Ameer <zaahid@komaticnc.co.za>
Subject: Re: Pro-forma Invoice
Attachment: PRE1058984.pdf_PDF_________________________________________________________546.gz (contains "PRE1058984.pdf_PDF_________________________________________________________546.exe")

Loki C2:
http://mecharnise.ir/da15/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 11:36:33 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7z6vcmijqxylvm4wzh7g5drqvrxdhdbus6fmjge7vqbacu2lh6dq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz fe7d51310985f0bab396c9fe6e8e30ac6e338c34978ac4989fac0201534b3f87

(this sample)

Loki

Executable exe 991e13e3b9c2e677d07ac57a29818b67faff846632bb9657b9af35e6fb92ea2a

  
Dropping
MD5 82da5dafd4811a76bc6387c9c427d3ca
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 991e13e3b9c2e677d07ac57a29818b67faff846632bb9657b9af35e6fb92ea2a

Comments