MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2de5b0a5d738f366bfca60f0ae46fb939784a8e803941b9fbb16f9c4259351cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2de5b0a5d738f366bfca60f0ae46fb939784a8e803941b9fbb16f9c4259351cc
SHA3-384 hash: 25a2d61d2e59ab20f3417d335369bbda04c0ae6f197c491401c3a01efc9cd2dbc4f2c8c37c202d4c3e4d46aa1b1e9f8a
SHA1 hash: cb92374eace0a2bba07777de478d8e02b78ed13f
MD5 hash: 50a4aa7278c3b9f7e8ebae91817eb6b5
humanhash: oregon-ink-equal-robin
File name:payment_swift.zip
Download: download sample
Signature Loki
Create hunting rule
File size:370'741 bytes
First seen:2020-08-03 06:55:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:OdTUbRXQmnTLs3TjDDgU8SlenfHO+STkXWobf9shRUZ/S8qyvyP1KoGHsII1W5uG:1bBQGA3TrL8SenBMkGYf9WRQIzP1Kotg
TLSH B9742340B96588F0E570D47A0437398AF9A80BF098C35FBDBE6238F8A94175527D9F06
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: pkz35-1-spamexpert2.hoster.kz
Sending IP: 185.111.104.18
From: aliya.istaeva@utari.kz
Subject: REMITTANCE ADVICE
Attachment: payment_swift.zip (contains "payment_swift.exe")

Loki C2:
http://beckhoff-th.com/kon/kon2/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.23482.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2de5b0a5d738f366bfca60f0ae46fb939784a8e803941b9fbb16f9c4259351cc/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 06:57:05 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fxs3bjoxhdzwnp6kmdyk4rx3solyjkhiaokbxh53c344ijmtkhga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/2de5b0a5d738f366bfca60f0ae46fb939784a8e803941b9fbb16f9c4259351cc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 2de5b0a5d738f366bfca60f0ae46fb939784a8e803941b9fbb16f9c4259351cc

(this sample)

Loki

Executable exe 9bcf29ef3bbb1003db97934e2412dfb77fc1d289797a9b4eab2af243bbc8987f

  
Dropping
MD5 31d0ad9c6cea44c5b54ffd6382a0a097
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9bcf29ef3bbb1003db97934e2412dfb77fc1d289797a9b4eab2af243bbc8987f

Comments