MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 093768049aa0359d4f5cd35d7e1a477c077ed7b52de97d8091193a5b1f9c254f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 093768049aa0359d4f5cd35d7e1a477c077ed7b52de97d8091193a5b1f9c254f
SHA3-384 hash: ac8fd849fd3791ff3dc68449eafa25cf355929faa1917c5d25fe1a4881f266797c21df810c77e003462c473ac149fb5e
SHA1 hash: b5163fc2e2fbecb517006b814096f2457d09108c
MD5 hash: bef9e9f829ddb11131876e706776c981
humanhash: saturn-seven-carpet-ack
File name:RFQ-HES 70054.rar
Download: download sample
Signature Loki
Create hunting rule
File size:23'480 bytes
First seen:2020-05-22 07:24:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:ciuGEDqwdTlzps/KQi3DUu0r7ut2pSqoriW9opMFe8Y4UTY+4d:cpDqa5l9UJrCPOW9mOx
TLSH 69B2E1EAD0FD70EA200136234407B6F8CDD6942B9D61E1AB1A7D226F0D77542F9B245F
Reporter abuse_ch
Tags:GuLoader Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: cloud-a7d9cc.managed-vps.net
Sending IP: 174.136.29.77
From: HIN MING WEI<info@globalsources.cf>
Subject: Aw: Business order RFQ-HES70054
Attachment: RFQ-HES 70054.rar (contains "RFQ-HES 70054.exe")

GuLoader payload URL:
http://ratamodu.ga/~zadmin/iclient/hermlk_qDqnTQXx228.bin

Loki C2:
http://egamcorps.ga/~zadmin/lmark/herm/mode.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 07:36:31 UTC
AV detection:
16 of 30 (53.33%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 093768049aa0359d4f5cd35d7e1a477c077ed7b52de97d8091193a5b1f9c254f

(this sample)

Loki

Executable exe 3b6bb1afefd752b5a272a0cf54fd6690171713fae7b852caec6beaa0e2f0f0e9

  
URLhaus
https://urlhaus.abuse.ch/url/361061/
  
Dropping
MD5 4397fd256c2b1ef5122c0855b17f17f9
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3b6bb1afefd752b5a272a0cf54fd6690171713fae7b852caec6beaa0e2f0f0e9

Comments