MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1638821adda67a903a655fb0bd3ddfaaa850e4dc5712a1996e02a76e1d56448e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1638821adda67a903a655fb0bd3ddfaaa850e4dc5712a1996e02a76e1d56448e
SHA3-384 hash: 7f91f184c819a58fd2d752722baa8c2700ed5d4071e890d1f1700aa56eaa43f0f78829c81f69ac68ad152327c10c921b
SHA1 hash: f6b27b21b42347c61f9cf20a11f2c4d1a7d2f296
MD5 hash: 2be870373657b5838629e0b8b3b4080b
humanhash: coffee-finch-rugby-ceiling
File name:ΔΩΡΕΑΝ ΕΝΤΥΠΟ ΕΓΓΡΑΦΗΣ.pdf.z
Download: download sample
Signature Loki
Create hunting rule
File size:432'961 bytes
First seen:2021-01-07 14:07:49 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:RQsWZAUA8mJ2xcNVQ66nm33FazNBo/1ZRdr9YmNYMWxpOOThOSTRbaZhWzo:apE8mwcX31aZB8rYmaMypOOtDlaZhW8
TLSH 3F942333BAA08F5B340FD3E6354EC34D308BD459E5215082BF1DBB61A7B963B12359A9
Reporter abuse_ch
Tags:geo GRC Loki z


Avatar
abuse_ch
Malspam distributing Loki:

HELO: correo.netgate.com.uy
Sending IP: 200.40.119.41
From: GREAT EXHIBITIONS <info@greatexhibitions.co>
Subject: ΔΩΡΕΑΝ ΕΓΓΡΑΦΗ ΕΓΓΡΑΦΗΣ ΠΡΟΣΑΡΤΗΜΕΝΗ ΓΙΑ ΜΕΛΗ
Attachment: ΔΩΡΕΑΝ ΕΝΤΥΠΟ ΕΓΓΡΑΦΗΣ.pdf.z (contains "ΔΩΡΕΑΝ ΕΝΤΥΠΟ ΕΓΓΡΑΦΗΣ.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
257
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1638821adda67a903a655fb0bd3ddfaaa850e4dc5712a1996e02a76e1d56448e/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-01-07 14:08:16 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cy4iegw5uz5jaotfl6yl2po7vkufbzg4k4jkdgloaktw4hkwisha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1638821adda67a903a655fb0bd3ddfaaa850e4dc5712a1996e02a76e1d56448e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z 1638821adda67a903a655fb0bd3ddfaaa850e4dc5712a1996e02a76e1d56448e

(this sample)

Loki

Executable exe c3aaed8d279e46404dc628565bec9faf27f8cec9f7f26d5254da63574fc3cb11

  
Dropping
MD5 03248a67c57c5e43168ec3a3307c36cf
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c3aaed8d279e46404dc628565bec9faf27f8cec9f7f26d5254da63574fc3cb11

Comments