MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f9ef2a39f9bb0b8f7d4a683f264c0125012ebf9aa981c696f3e280383bb38c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2f9ef2a39f9bb0b8f7d4a683f264c0125012ebf9aa981c696f3e280383bb38c1
SHA3-384 hash: b05b6b9f7f5d0248dc2228f39fcd60699ac5b8cc7de1ccfc7fa7ae1f9ac3752a052344e266f0db5f3287ca7ca3c05e4a
SHA1 hash: 935063222b878723c1a860a7b902024722299d40
MD5 hash: 9f58c1656918d39f0692d9997e68ea1f
humanhash: vermont-fanta-blossom-robin
File name:BBVA_SWIFT_PAYMENT.rar
Download: download sample
Signature Loki
Create hunting rule
File size:309'090 bytes
First seen:2020-11-20 07:57:51 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:faR/jVFPx8Ru27vsXFxfLtzBnP47rjx4o5dv/2e8ZGDUFHNrT5GTwI23:ydVFPwZbyxfJCfDvue8ZmUFHNrT5GMIe
TLSH E1642282DCECC64D5FA09D8716E74662CD13E40DE5CB5F9EBC2DA12034B9EA94407AB3
Reporter abuse_ch
Tags:BBVA Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server.filmworld.tv
Sending IP: 70.32.31.17
From: BBVA Advising Service <f016252ee@opplus.bbva.com>
Reply-To: BBVA Advising Service <pkd.lycheu@gmail.com>
Subject: RE: BBVA200227-10106 ## International Payment
Attachment: BBVA_SWIFT_PAYMENT.rar (contains "6FmrsohIP6g8w7i.exe")

Loki C2:
http://azzmtool.com/zoro/zoro5/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
134
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2f9ef2a39f9bb0b8f7d4a683f264c0125012ebf9aa981c696f3e280383bb38c1/
Threat name:
ByteCode-MSIL.Trojan.Sudloader
Create hunting rule
Status:
Malicious
First seen:
2020-11-20 06:12:22 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f6ppfi47toylr56uu2b7ezgacjibf27zvkmby2lphyuaha53hdaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2f9ef2a39f9bb0b8f7d4a683f264c0125012ebf9aa981c696f3e280383bb38c1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 2f9ef2a39f9bb0b8f7d4a683f264c0125012ebf9aa981c696f3e280383bb38c1

(this sample)

Loki

Executable exe d360c9e6e48a05779c84ba7355a20730d391a65ac08b1338033ec862851abbed

  
Dropping
MD5 d3d36b80287b74a0ebedaef9e95085f2
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d360c9e6e48a05779c84ba7355a20730d391a65ac08b1338033ec862851abbed

Comments