MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 242ada5239f0a59281e5432a1d8c5af4e44c4c1638d5d8a84939b19b007072bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 242ada5239f0a59281e5432a1d8c5af4e44c4c1638d5d8a84939b19b007072bd
SHA3-384 hash: d80e1f0ac69bafd8521260b30162ad8ef63c8c93248f94f2db7db0770b3fd0c1108601f1ff01f8b40f045ffede0c53d3
SHA1 hash: 63b8b27280f7d746706dcb58543adf8cf20183a8
MD5 hash: e27495a2b3ae8468323c88f5d4254f7a
humanhash: leopard-delta-kansas-uncle
File name:PO.2017174595.gz
Download: download sample
Signature Loki
Create hunting rule
File size:433'426 bytes
First seen:2020-06-04 06:41:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:61hoQBtYKIfywx/UDbEWP68QZ4S7XKtibFx3b:yBhIKwWDD68QZ4SjK4bb
TLSH 789423556CB33524920CE86F82C03F1D2F05B9B1360645B1F4C4AE9F296B8FECD9A95A
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mails.hatchlogics.ml
Sending IP: 193.142.59.119
From: Wendy Fung <judy@hatchlogics.ml>
Subject: PURCHASE ORDER PO.2017174595
Attachment: PO.2017174595.gz (contains "Secured.exe")

Loki C2:
http://sockmanes.ml/overcone/logs/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Povertel
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 07:37:10 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eqvnuurz6cszfapfimvb3dc26tseytawhdk5rkcjhgyzwadqok6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 242ada5239f0a59281e5432a1d8c5af4e44c4c1638d5d8a84939b19b007072bd

(this sample)

Loki

Executable exe 0a5c490fd9b09f59af4428e01b959f6879d41edf04424cd90dc3b3868c19697e

  
Dropping
MD5 d35b60cec8b46b03b04470dde63fed28
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0a5c490fd9b09f59af4428e01b959f6879d41edf04424cd90dc3b3868c19697e

Comments