MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ffe67c2f5005a91c9314f5f894d451147ea591d7ca47505a71f8e52d29753de0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ffe67c2f5005a91c9314f5f894d451147ea591d7ca47505a71f8e52d29753de0
SHA3-384 hash: 6a2d9b20643ef9e02bf6f0e3cab72a339f49e943e6c11d35997c4a886e6263fcbcc8abf70fd6e71271ed491524e81828
SHA1 hash: 7116109ec21e299142270ea7edc65ec5bd1c66d5
MD5 hash: 6293212359f7b93e61c23470e002bc43
humanhash: oxygen-mobile-bravo-saturn
File name:request_doc_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:373'793 bytes
First seen:2020-05-04 20:18:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:B081UfGDWd10NiYrx4UATO2w0sbmVMM2F/kTUaQHgMan4:ayUfcWjYyUATlwtb2ABAPn4
TLSH A98423F4E18B6465C508DA7E0381B24C2A3468DE7EA3D3FA87055B5279302A273F747E
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: clayenergy.com.fj
Sending IP: 103.133.111.75
From: Mr. Chan <ilaisa@clayenergy.com.fj>
Subject: PRICE REQUEST
Attachment: request_doc_pdf.gz (contains "Scan08_pdf.exe")

Loki C2:
http://broken1.cf/L8/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.24839.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 17:43:22 UTC
File Type:
Binary (Archive)
Extracted files:
61
AV detection:
36 of 48 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=77thyl2qawurzeyu6x4jjvcrcr7kleoxzjdvawtr7dss2klvhxqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip ffe67c2f5005a91c9314f5f894d451147ea591d7ca47505a71f8e52d29753de0

(this sample)

Loki

Executable exe 3b6de85bfdcfac9d315787e62d8891f6b472ca78cc97b12414019b84901433e8

  
Dropping
MD5 11a66e8579d364eb7e0128654bd25638
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3b6de85bfdcfac9d315787e62d8891f6b472ca78cc97b12414019b84901433e8

Comments