MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 071624c44be2ff4fba1324f744a9463a69f4aafc8548fd112d9b6d371920b3f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 071624c44be2ff4fba1324f744a9463a69f4aafc8548fd112d9b6d371920b3f7
SHA3-384 hash: 4eba49a187521b0db909e50a96f49b404cfb57773be4aa0707f46c80738bc1c0834de77de3368857cef3df994fa866d0
SHA1 hash: da48498b49f719735e9540d79d29c666fe09ff33
MD5 hash: 7aad5cfeb73394244c2499fd09da26b4
humanhash: uranus-venus-vegan-monkey
File name:over-due-INV TIL19063.pdf.arj
Download: download sample
Signature Loki
Create hunting rule
File size:777'161 bytes
First seen:2020-05-14 06:02:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:o2HlsOV8jX46ioLIIVloeaseoYrF4j8OuiPum9q725B8ILuhBKO0miz2BLssR2p:oUqOV8zLIr5ryj8OPufuDuhUfmiSBdkp
TLSH E8F423BDD4493004CE3D88BA5D852B4263B578FB0F0B75893935AF2C42E1D58A9D93BE
Reporter abuse_ch
Tags:arj Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: pkz49-2-spamexpert2.hoster.kz
Sending IP: 185.111.104.47
From: a.zhunysova@shanyrak-group.kz
Subject: Re:RE: RE: RE: Re: Overdue invoice number TIL19063 ( Your PO-SG19-044 )
Attachment: over-due-INV TIL19063.pdf.arj (contains "over-due-pdf.exe")

Loki C2:
http://eocaenlogistics.com/data/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25906.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 05:16:28 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a4lcjrcl4l7u7oqtet3ujkkghju7jkx4qvep2ejntnwtogjawp3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 071624c44be2ff4fba1324f744a9463a69f4aafc8548fd112d9b6d371920b3f7

(this sample)

Loki

Executable exe 375170c06f60f8f1529ae7c6cee9459118abd5b180fa70cbe82226c0b1deb09d

  
Dropping
MD5 9468d49cd6b26b3611a59998c39ec192
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 375170c06f60f8f1529ae7c6cee9459118abd5b180fa70cbe82226c0b1deb09d

Comments