MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1642a17a4e3f94c8b6fc3bf0785b8bc3bf27fe067e1199d915cf4317c1765e1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1642a17a4e3f94c8b6fc3bf0785b8bc3bf27fe067e1199d915cf4317c1765e1b
SHA3-384 hash: f01bc443ff3a60b59f850ca8aeb4bef1f3286529e3ceb044fb30b0fdda43553647246493861c2e9a98c088ed9f3c1ccf
SHA1 hash: 2ef71d0de90247e8e30151d903110cbbe932cb31
MD5 hash: 06a53dfe41a23b5a622fe4915e41e715
humanhash: ohio-vegan-freddie-london
File name:New Order.pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:504'705 bytes
First seen:2020-10-14 15:53:14 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:b/Gwz7aefcn5I/Pyk3v58D6A2PUz/W23g5Hx8NMSRar:b//avC/afz/Mz82SRA
TLSH 24B423B357F2C78D38E966B201B52314A27BB37C95312DD28DAA67C90CF44439B19B39
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: xbx0.802.omre.ga
Sending IP: 159.65.155.23
From: "Nguyen Quoc Thong" <nqthong@802.omre.ga>
Subject: Re: Purchase Order
Attachment: New Order.pdf.gz (contains "New Order.pdf.exe")

Loki C2:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27281.GZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1642a17a4e3f94c8b6fc3bf0785b8bc3bf27fe067e1199d915cf4317c1765e1b/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 12:38:13 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=czbkc6soh6kmrnx4hpyhqw4lyo7sp7qgpyiztwivz5brpqlwlynq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1642a17a4e3f94c8b6fc3bf0785b8bc3bf27fe067e1199d915cf4317c1765e1b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 1642a17a4e3f94c8b6fc3bf0785b8bc3bf27fe067e1199d915cf4317c1765e1b

(this sample)

Loki

Executable exe ad6946570be39c2f4da1777083f2339cae24bec7928b460db68e55e53c915e22

  
Dropping
MD5 0b15ce835aa40079bf2252263db4da2a
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ad6946570be39c2f4da1777083f2339cae24bec7928b460db68e55e53c915e22

Comments