MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23b12f938df9e206ed83092c235a7590bed2cd3f42c7379e04c40100adcecfdf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 23b12f938df9e206ed83092c235a7590bed2cd3f42c7379e04c40100adcecfdf
SHA3-384 hash: 9cc80fbcb6660e6fa9e223a8e045829d563c2cbfe69588d64d49c3bc76017df48b79ee837874ee1e337e968e5547f83c
SHA1 hash: 66a50747fbf48986053a27e46a49aa84d37bebd6
MD5 hash: 41f1a02a5f1458110fe83f580120e797
humanhash: sad-sweet-potato-potato
File name:COMPROBANTE DE PAGO._PDF_______________________________________________________________64746473.gz
Download: download sample
Signature Loki
Create hunting rule
File size:328'788 bytes
First seen:2020-07-21 16:12:27 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:lMXl9uNpRApVts8iwMymbP0auShsbbTb3B4T8UH6oyl6N:6XyfR2DBmbbuSM+gUHpjN
TLSH 436423788A2AD8A0D11A7C70A243D78D3AC00E5FF47FB3DA419A12F47D75761ACA1EC5
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server.logicon.ro
Sending IP: 85.204.22.11
From: amaldonado@amber.ec
Subject: COMPROBANTE DE PAGO
Attachment: COMPROBANTE DE PAGO._PDF_______________________________________________________________64746473.gz (contains "COMPROBANTE DE PAGO._PDF_______________________________________________________________64746473.exe")

Loki C2:
http://mecharnise.ir/ea4/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/23b12f938df9e206ed83092c235a7590bed2cd3f42c7379e04c40100adcecfdf/
Threat name:
ByteCode-MSIL.Trojan.MassLogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 16:14:07 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eoys7e4n7hran3mdbewcgwtvsc7nftj7ildtphqeyqaqblooz7pq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/23b12f938df9e206ed83092c235a7590bed2cd3f42c7379e04c40100adcecfdf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 23b12f938df9e206ed83092c235a7590bed2cd3f42c7379e04c40100adcecfdf

(this sample)

Loki

Executable exe 8a6b4a9aa425ad3d577b2b06d4acc73ba92d0878b4edd160872f130b60bf41cc

  
Dropping
MD5 8c4f31c31ceb59b77b7b816f7d8b80cf
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8a6b4a9aa425ad3d577b2b06d4acc73ba92d0878b4edd160872f130b60bf41cc

Comments