MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 097aa26f1e55054cf0c8852cf80f36a141b04d7c10ad92da425237732fc4a06e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 097aa26f1e55054cf0c8852cf80f36a141b04d7c10ad92da425237732fc4a06e
SHA3-384 hash: da3e9102bf3f32557fc6f390180d216631a985344d46ad499110386202357f65c7da41f4c268f7ce5691e414968851a2
SHA1 hash: 00d36568660758184833748cd369386b063ec166
MD5 hash: ffc54f75902e8429e711f42f302c0dcb
humanhash: romeo-washington-double-kilo
File name:PO.W424676.rar
Download: download sample
Signature Loki
Create hunting rule
File size:575'463 bytes
First seen:2020-10-12 06:15:22 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:emxA5ds3F++QmLmMIUeYbsfgJT54oLFmG7Eaq+nY:eme58nWMYYkgJWoLgiRvnY
TLSH BAC4234BBDCCF18C9338A3BA9652D109773BD6037DBDAAA62B8054436FD5441C691C3B
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server.filmworld.tv
Sending IP: 70.32.31.17
From: Lift Freight Services <lfsrtn.sales@liftfreight.com>
Reply-To: webbymas@yahoo.com
Subject: NEED NEW TAX INVOICE PO#140797
Attachment: PO.W424676.rar (contains "PO.W424676.exe")

Loki C2:
http://linkk-my.com/kaka/kaka5/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/097aa26f1e55054cf0c8852cf80f36a141b04d7c10ad92da425237732fc4a06e/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bf5ke3y6kucuz4giquwpqdzwufa3atl4ccwzfwscki3xgl6eubxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/097aa26f1e55054cf0c8852cf80f36a141b04d7c10ad92da425237732fc4a06e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 097aa26f1e55054cf0c8852cf80f36a141b04d7c10ad92da425237732fc4a06e

(this sample)

Loki

Executable exe 792259d9e6e262d17cc54f4b43c8e95cd0be1e533f5e5032a5cdefb9f899a6a2

  
Dropping
MD5 e4d31d9bffe88f21edc58fbf83bc0d69
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 792259d9e6e262d17cc54f4b43c8e95cd0be1e533f5e5032a5cdefb9f899a6a2

Comments