MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1cf92737308fab8a3e03772a9d884465398edf86fb379086e8bcbc0b6b3e720c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1cf92737308fab8a3e03772a9d884465398edf86fb379086e8bcbc0b6b3e720c
SHA3-384 hash: 232f706cb0cdf331e5d6d563373f1f0eb5ccf950679934d2cece2684d8aa3d176777f760cdb486d4168760812959bdc1
SHA1 hash: e0f0c130efee295e081ac80b4da28c6d38987c69
MD5 hash: 50b7e248eebdce36da2ed952edccd193
humanhash: johnny-glucose-don-six
File name:BKGCONF_SGN0769156.arj
Download: download sample
Signature Loki
Create hunting rule
File size:376'815 bytes
First seen:2020-08-13 13:47:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Qs5VWfVFt8iDVTDpyAO3R9Jaunf/dInG7TLJROhHdiabWYf+NKot9KQ:v5AVMmTFGZac2WRgJdvRot9KQ
TLSH 808423A357D52C446D3B302FB56A391CB8CA9431DD46B61C803B65EE301AEBBA237E15
Reporter abuse_ch
Tags:arj Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server.lemcon-asia.com
Sending IP: 209.182.203.225
From: lanhtn mlahcm <lanhtn@marina-logistics.com>
Subject: RE: SHIPPING INSTRUCTION FOR PO#M-26002645. - BOOKING SGN0754853 >>> SGN0769156
Attachment: BKGCONF_SGN0769156.arj (contains "BKGCONF_SGN0769156.exe")

Loki C2:
http://marqaritellimoney.com/zoro/zoro3/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Variant.Zusy.311248.5720.6726.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1cf92737308fab8a3e03772a9d884465398edf86fb379086e8bcbc0b6b3e720c/
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 13:49:04 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dt4sonzqr6vyupqdo4vj3ccemu4y5x4g7m3zbbxixs6aw2z6oiga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1cf92737308fab8a3e03772a9d884465398edf86fb379086e8bcbc0b6b3e720c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 1cf92737308fab8a3e03772a9d884465398edf86fb379086e8bcbc0b6b3e720c

(this sample)

Loki

Executable exe 828380da7d30a2c2be6dc1b5d8aeb66c4fa76087cb8cd3e9ac04d813d31c6d9a

  
Dropping
MD5 d51a0774df2bf185cb5e2bbdfab86bcd
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 828380da7d30a2c2be6dc1b5d8aeb66c4fa76087cb8cd3e9ac04d813d31c6d9a

Comments