MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a58da57490188288401779c06959f64b088151c536e5d7308b0c73942b3a826. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a58da57490188288401779c06959f64b088151c536e5d7308b0c73942b3a826
SHA3-384 hash: c0fef69a6f2622d474031e3c7da14ab5ede3bd84f68d641f19c4adba89c6a6792233059704ec15bfd477dc6fb7fe611f
SHA1 hash: e2cea7968d04aa61922aaa25dc03187c71d36a23
MD5 hash: 78a8f97e537b1176d87911b6fb7329c0
humanhash: earth-apart-carpet-echo
File name:Bank wire receipt.rar
Download: download sample
Signature Loki
Create hunting rule
File size:399'884 bytes
First seen:2020-08-03 07:15:33 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:8OvO1wsXhPRd2LcxZOn9aGbD7kL6wOQJfX4M:8LqGpP2U29HC/4M
TLSH 50842363778BF89F4D516BD1C2482C31452623F566EE3EADE440A9366CA437BCAB02D1
Reporter abuse_ch
Tags:Loki rar UPS


Avatar
abuse_ch
Malspam distributing Loki:

HELO: s131.coreserver.jp
Sending IP: 202.172.28.132
From: Cindy Lopez<default@thdr.jp>
Reply-To: <Cindy.Lop@aaglobalimports.com>
Subject: RE: RE: RE:UPS Shipment 779945110T:**WIRE COFIRMATION
Attachment: Bank wire receipt.rar (contains "Bank wire receipt.exe")

Loki C2:
http://modevin.ga/~zadmin/lmark/gld/mode.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a58da57490188288401779c06959f64b088151c536e5d7308b0c73942b3a826/
Threat name:
Win32.Trojan.Injuke
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 03:58:53 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bjmnuv2jagecrbabo6oanfm7msyiqfi4knxf24yiwddtsqvtvata._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0a58da57490188288401779c06959f64b088151c536e5d7308b0c73942b3a826

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 0a58da57490188288401779c06959f64b088151c536e5d7308b0c73942b3a826

(this sample)

Loki

Executable exe cdddaa32a17f3dfb1d00f35354c29a0b949d709839785d879ea203cf18c57f24

  
Dropping
MD5 9a6e44f7179f2aa4f7ee7d127b5112be
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cdddaa32a17f3dfb1d00f35354c29a0b949d709839785d879ea203cf18c57f24

Comments