MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f68dc994b55a0a9ae9ba29b3bec40f9731c5af0b5cff3bc035978890935a5b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f68dc994b55a0a9ae9ba29b3bec40f9731c5af0b5cff3bc035978890935a5b3
SHA3-384 hash: 8169be2dbc47c220b177c2478d8fc92fc3aba4401f2b93bc3ec03aa9dfa5b09593b0f11d6b479879a816022077fa095d
SHA1 hash: 3386f8427f8e57aa9e3467831f4803c9b3c48fb5
MD5 hash: f16e59b2554ee356a2d99266d615ea40
humanhash: charlie-illinois-virginia-maine
File name:scan00465.pdf.zip
Download: download sample
Signature Loki
Create hunting rule
File size:195'051 bytes
First seen:2020-05-29 05:53:21 UTC
Last seen:2020-05-29 18:53:18 UTC
File type: zip
MIME type:application/zip
ssdeep 3072:ZEL04QINtjFakdz6qt3hwxMmfifFxJJiSPLkrhVMJqlRM3avVejhnLU:ZvNIv8+6KkfaxJJd7qlRMqvUnQ
TLSH DF1413AAEB10B18ECEE4EEE3928C7486117C1D1E3DBC5A33B5BB351C5154F990B4EA11
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: hansoll.com
Sending IP: 156.96.62.53
From: (Ms) Franziska Glas <annapark@hansoll.com>
Reply-To: (Ms) Franziska Glas <anriapark@hansoll.com>
Subject: revised product enquiry
Attachment: scan00465.pdf.zip (contains "scan00465.pdf.exe")

Loki C2:
http://20gharch.ir/catalog/mike/fre.php

Intelligence

File Origin
# of uploads :
4
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Grp
Create hunting rule
Status:
Malicious
First seen:
2020-05-29 06:36:31 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 1f68dc994b55a0a9ae9ba29b3bec40f9731c5af0b5cff3bc035978890935a5b3

(this sample)

Loki

Executable exe 4d3e8c6d43fcdf1f060986547c0d0af4a27c4ebe9377b374c6981f27d317d5cf

  
Dropping
MD5 9da76ccff3dba8b0a81bcaa89e16eb0a
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4d3e8c6d43fcdf1f060986547c0d0af4a27c4ebe9377b374c6981f27d317d5cf

Comments