MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f82183c316e35be371aa5e2d431483febea1fa5b66c72ddf67e037f60f9cdde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f82183c316e35be371aa5e2d431483febea1fa5b66c72ddf67e037f60f9cdde
SHA3-384 hash: 47b869baa28606e41744a8e3b37ceed67ab8729d13f14e4f2c2e5eb18bc9a5b7063969433f9889ff33af3a3a96cb80b5
SHA1 hash: 783105cb21d496fa449089f58fc9174af4c47a5b
MD5 hash: 5355a9197e5bc5aab5da275d6537c226
humanhash: july-wisconsin-solar-low
File name:purchase order_pdf______________________________________________.gz
Download: download sample
Signature Loki
Create hunting rule
File size:335'739 bytes
First seen:2020-08-19 14:52:26 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:PqVxUpSEo87mIFsde7aGqtPcfnxEtAMvdI4YN+7D5NvkzDV3l4mcmOF9v+qcG/gR:yvUIo7mIFs6TqtyxsAMFIv+/rkpSmcmp
TLSH 8D6423D1170E309B0D0915E9930F428E23FD4489960ADA5B87732A5B7B64DE2BEDFC6C
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: auto-deal.gr
Sending IP: 45.137.22.56
From: Nicholas Rivecca<xasapi@auto-deal.gr>
Subject: RE: purchase order
Attachment: purchase order_pdf______________________________________________.gz (contains "purchase order_pdf______________________________________________.exe")

Loki C2:
http://electtrolvx.com/kudi/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200820-0815.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f82183c316e35be371aa5e2d431483febea1fa5b66c72ddf67e037f60f9cdde/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-08-19 03:38:13 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d6bbqpbrny234ny2uxrnimkih7v6uh5fwzwhfxpwpybx6yhzzxpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1f82183c316e35be371aa5e2d431483febea1fa5b66c72ddf67e037f60f9cdde

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 1f82183c316e35be371aa5e2d431483febea1fa5b66c72ddf67e037f60f9cdde

(this sample)

Loki

Executable exe 76e0ef504371de843a6197e948a1a1dfe3f8e87e25ff8e2ee5f6648daff0e0c6

  
Dropping
MD5 bc31eb200e594f57c559354c18fe45a5
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 76e0ef504371de843a6197e948a1a1dfe3f8e87e25ff8e2ee5f6648daff0e0c6

Comments