MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1aa2f2000a99eebefc1e7207caff35528fb494a27df832b7479f644fec8f1b3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1aa2f2000a99eebefc1e7207caff35528fb494a27df832b7479f644fec8f1b3d
SHA3-384 hash: 552491e20cd1cb5a888c7cf9cd9b3941cf6ab6b836fea33d60d7f09a355f4c68692193eeacd4bfc5f7005aaae6b3497e
SHA1 hash: 20d10dd0bd662030fdb132ef6115588c95bc809a
MD5 hash: d64974ddbcadf74e2ee3fed766da23b3
humanhash: michigan-sierra-august-queen
File name:PI_Nov9071011998_ENTRUSTpdf.arj
Download: download sample
Signature Loki
Create hunting rule
File size:297'373 bytes
First seen:2020-12-03 08:56:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:U3qNidwGZgllZ4ix0hFLXbfkruCroVj2ghfzK47kgX9:U6ItojxC77nHj5W4QgX9
TLSH 3D5423636EDBB4BF4A8C13A84313BF1405E18E1A30D1E657E1597A9BD163CF38E8B512
Reporter abuse_ch
Tags:arj Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: cpanel3.centrin.net.id
Sending IP: 202.146.241.47
From: Entrust Shipping <acctg@entrust.cn>
Reply-To: acctg@entrust.cn
Subject: PI_Nov9071011998_Entrust // ASAP
Attachment: PI_Nov9071011998_ENTRUSTpdf.arj (contains "PI_Nov9071011998_ENTRUSTpdf.exe")

Loki C2:
http://webtex.ga/ibiki/gate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
141
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1aa2f2000a99eebefc1e7207caff35528fb494a27df832b7479f644fec8f1b3d/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dkrpeaakthxl57a6oid4v7zvkkh3jffcpx4dfn2ht5se73epdm6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1aa2f2000a99eebefc1e7207caff35528fb494a27df832b7479f644fec8f1b3d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 1aa2f2000a99eebefc1e7207caff35528fb494a27df832b7479f644fec8f1b3d

(this sample)

Loki

Executable exe 9e196418dece3402ea9627106e6e246d5186392f25f8ada694598168481fb0bf

  
Dropping
MD5 2349d50a67c2ef85661ef2be6def2cc3
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9e196418dece3402ea9627106e6e246d5186392f25f8ada694598168481fb0bf

Comments