MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12aa41f9dd8a547585ad9c0299fbeca4ce347381a0007674b1d6cc4e4b56678d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12aa41f9dd8a547585ad9c0299fbeca4ce347381a0007674b1d6cc4e4b56678d
SHA3-384 hash: f2b6ea5bf3a0d3733e50647d23bbdda972538542391bc975b6630787cc463120261ae2d8036122ca05a6f5a67c61745b
SHA1 hash: 017cdbc7569cf4e12a14763e9fbf49e86c8d6d18
MD5 hash: 2d0e2013502b234760aff02014a5e9e7
humanhash: lamp-nineteen-oxygen-batman
File name:PO.zip
Download: download sample
Signature Loki
Create hunting rule
File size:775'901 bytes
First seen:2020-06-08 07:56:18 UTC
Last seen:2020-06-08 07:59:42 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:XE6RCHtXzBeFKpWqN6jwcXKfkfxh5KJbzQN1ZTJPjuEIil7fD6Sarmr+DWBETeWg:butjBeFKYqNtc6fkZobzQN1xVrbdYlDW
TLSH 69F433C50207D0BC0E263B588BA35D8CF811BD55AE5F21ADB89CE4FD99D38B84D23678
Reporter cocaman
Tags:Loki zip


Avatar
cocaman
Malicious email
From: " Brisco Imports and Exports LTD " <info@cortamgroup.ml>
Received: from server0.cortamgroup.ml (server.cortamgroup.ml [23.254.224.206])
Date: Mon, 08 Jun 2020 00:44:10 -0700
Subject: Purchase Order.
Attachment: PO.zip

Intelligence

File Origin
# of uploads :
2
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Sanesecurity.Malware.21241.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 07:58:06 UTC
File Type:
Binary (Archive)
Extracted files:
94
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ckved6o5rjkhlbnntqbjt67muthdi44buaahm5fr23ge4s2wm6gq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 12aa41f9dd8a547585ad9c0299fbeca4ce347381a0007674b1d6cc4e4b56678d

(this sample)

Loki

Executable exe ca70168a3b0c1e1ad0232faef2d5a3cee6f36a17f174ac5692e9c930beba62a0

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ca70168a3b0c1e1ad0232faef2d5a3cee6f36a17f174ac5692e9c930beba62a0
  
Dropping
Loki

Comments