MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1435909b9076017bbe80b8e454fb3d59361cc1d7ee5f5f0f350eb0eee4e8ae88. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1435909b9076017bbe80b8e454fb3d59361cc1d7ee5f5f0f350eb0eee4e8ae88
SHA3-384 hash: 4bc925023d94c55abb99beec3adbc458883c069662cf5f5fdd2ede7c7d5538766521ecc4d59d5b88246ae16c828cef83
SHA1 hash: a7a11ed3bc61d650d0e0bd0e737fdc66a861ce43
MD5 hash: 0afcf040e521acf33474e2552fca154c
humanhash: queen-oven-texas-freddie
File name:Canon Invoice - SG191009 SG191008-pdf.rar
Download: download sample
Signature Loki
Create hunting rule
File size:338'423 bytes
First seen:2020-11-20 07:39:15 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:STP70Lbblibic4tOhuRqa9Iugwy7cAMHPdihclp5htpbkbiP5M4JXbo5xqnkqn0Z:M70Lb5ibd4oBas3AA2d+c3JpbkWM4JXY
TLSH E174238ECE54D9FA43A2AC01E5C85DD257973C2CF3487F3088A996ADF5BE3D61439086
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.intelmed.kg
Sending IP: 77.235.21.148
From: Гульбайра Максуталиева <g.maksutalieva@intelmed.kg>
Subject: Liability Over Due Oct Invoice 2020- SG19100009 & SG191000008
Attachment: Canon Invoice - SG191009 SG191008-pdf.rar (contains "Canon Invoice - SG191009 & SG191008-pdf.exe")

Loki C2:
http://firnabulking.com/class/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1435909b9076017bbe80b8e454fb3d59361cc1d7ee5f5f0f350eb0eee4e8ae88/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-11-20 07:40:06 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cq2zbg4qoyaxxpuaxdsfj6z5le3bzqox5zpv6dzvb2yo5zhiv2ea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 1435909b9076017bbe80b8e454fb3d59361cc1d7ee5f5f0f350eb0eee4e8ae88

(this sample)

Loki

Executable exe 508bdc3668fe3bd2512d398615e6ff998e3df2b9bee88e16725be7f8d5e8db6e

  
Dropping
MD5 1af58451c187ceee9f662950497814de
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 508bdc3668fe3bd2512d398615e6ff998e3df2b9bee88e16725be7f8d5e8db6e

Comments