MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 113c7af3c4cdd72033370f9a18767f35c382ab153d69b04b6959a2b98585b5d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 113c7af3c4cdd72033370f9a18767f35c382ab153d69b04b6959a2b98585b5d9
SHA3-384 hash: 8949b1b6e7e0cc6fc5f04a010803fcbbdcb2fe808596eb6af6ca532ab0e3ffb75224dd9bac5e6d4dc49fd5c00547a5d4
SHA1 hash: 6f2ce587135aa3bdd84588b4a0bf6d663f47af62
MD5 hash: 8fc5733f6726b01a4689ea9074292884
humanhash: harry-quebec-friend-five
File name:TDC-2019042.gz
Download: download sample
Signature Loki
Create hunting rule
File size:383'235 bytes
First seen:2020-08-13 05:45:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:0PcyHbl8o7Eu9CjuhZLlPMHG3lw6Gnf0M8pTePsH2JFlxgsrUUeC8vMKKeIBex6X:eRHblFomCjQdlkHG3qfA98sHujd/8vdY
TLSH D0842370FFABFA7632A1E4373DE1AAA5F40729092FB2DD74DD2066B12659DD0C024D48
Reporter cocaman
Tags:gz Loki


Avatar
cocaman
Malicious email
From: "JH.G Son" <sonia@lbpl.com.cn>
Received: from mail.lbpl.in (mail.lbpl.in [142.4.18.137])
Date: Wed, 12 Aug 2020 16:12:25 +0530
Subject: PAYMENT FORM BACK ORDER & PI TDC-2019042
Attachment: TDC-2019042.gz

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.BackDoor.SpyBotNET.25.28221.1486.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/113c7af3c4cdd72033370f9a18767f35c382ab153d69b04b6959a2b98585b5d9/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 20:43:39 UTC
File Type:
Binary (Archive)
Extracted files:
65
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ce6hv46ezxlsamzxb6nbq5t7gxbyfkyvhvu3as3jlgrltbmfwxmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/113c7af3c4cdd72033370f9a18767f35c382ab153d69b04b6959a2b98585b5d9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 113c7af3c4cdd72033370f9a18767f35c382ab153d69b04b6959a2b98585b5d9

(this sample)

Loki

Executable exe 676867153d6ee1465a298e33b59142e1706eb01e0cdf7a7cb829535195b71f0b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 676867153d6ee1465a298e33b59142e1706eb01e0cdf7a7cb829535195b71f0b
  
Dropping
Loki

Comments