MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21f970924a588bb7329a93f661196c227c0db1a143f3215de4a07f457ab08c23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21f970924a588bb7329a93f661196c227c0db1a143f3215de4a07f457ab08c23
SHA3-384 hash: 6c2492faf5968b1d968f528619ecb23a8bd41be191a0633329504dadfa3ca31e02c2deba6038347bf2fcee30c7edf7b7
SHA1 hash: 5bcd576ae0d92147d0ad13b6a8353430f2f216aa
MD5 hash: a1add268d3c6df799f81b3524d17dcb8
humanhash: berlin-xray-pasta-bulldog
File name:FF064535.rar
Download: download sample
Signature Loki
Create hunting rule
File size:329'407 bytes
First seen:2020-08-18 19:40:22 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:O8RYr7DUWj6pGc5rnZA6UYU9i99kLQzcXOIchmmR5blWyXWC7PZ:OUpL5so99KeI8mmfWY
TLSH CD6423CE08FCC7451F2E906321863995332B6497489B252A6B0DAFF23B79A7C7477742
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail-cld-x12.trdns.com
Sending IP: 77.245.145.62
From: Mail Notification victim-domain <ecabioglu@er-ah.net>
Subject: INVOICE ON victim-domain PO18146 victim-email
Attachment: FF064535.rar (contains "FF064535.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/21f970924a588bb7329a93f661196c227c0db1a143f3215de4a07f457ab08c23/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 19:42:07 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eh4xbesklcf3omu2sp3gcglmej6a3mnbipzscxpeub7uk6vqrqrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/21f970924a588bb7329a93f661196c227c0db1a143f3215de4a07f457ab08c23

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 21f970924a588bb7329a93f661196c227c0db1a143f3215de4a07f457ab08c23

(this sample)

Loki

Executable exe b959bd8fd5a11aeb743ae5f33ad7fe4176d564353f7a68359f9d8b2f4e849779

  
Dropping
MD5 d6d7b73649613c96e5291c3e6a14867b
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b959bd8fd5a11aeb743ae5f33ad7fe4176d564353f7a68359f9d8b2f4e849779

Comments