MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06490b9336522d5a107285d5ef573f8b4e43b4aba5cd85a8f293681014b8a917. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 06490b9336522d5a107285d5ef573f8b4e43b4aba5cd85a8f293681014b8a917
SHA3-384 hash: e9e8b17b934e0742d42597d390f757b985e6b11eeb3453bcd5a6958ce06fb26bffc2e6e5eb670e1a362fead9cba75971
SHA1 hash: dbd5cb871d763c0361d3fc18a39f25498b63b9b6
MD5 hash: 542f48eb7b5d9907eb06b98b86332b77
humanhash: shade-emma-grey-asparagus
File name:review.newlist_pdf.z
Download: download sample
Signature Loki
Create hunting rule
File size:318'741 bytes
First seen:2020-10-12 19:19:07 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:Ikp7/XDmyao4UJZhedSvcCssFWE91kZJl0im4iXyZ099cOzyGxaHBLE7s3dx9EZE:Z7/X6UJjeEc6Q1kXc89cO2G4H9T3r9
TLSH 746423BA095BA7A9F35B9BD7428D17E56232948C3F4D0132D68FB830EC06325A59C793
Reporter abuse_ch
Tags:Loki z


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.mozadom.ga
Sending IP: 168.235.109.227
From: David Cooper <admin@mozadom.ga>
Subject: All the shows. All week. All free.
Attachment: review.newlist_pdf.z (contains "review.newlist_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/06490b9336522d5a107285d5ef573f8b4e43b4aba5cd85a8f293681014b8a917/
Threat name:
Win32.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 18:32:05 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=azeqxezwkiwvuedsqxk66vz7rnhehnfluxgylkhssnubaffyvelq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/06490b9336522d5a107285d5ef573f8b4e43b4aba5cd85a8f293681014b8a917

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z 06490b9336522d5a107285d5ef573f8b4e43b4aba5cd85a8f293681014b8a917

(this sample)

Loki

Executable exe fd90557e0458ee25e77c071644c13da6867ebb321b672d13f0d7cf188efeb04d

  
Dropping
MD5 f83dcc927c073b908047214c63772051
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fd90557e0458ee25e77c071644c13da6867ebb321b672d13f0d7cf188efeb04d

Comments