MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 397710347e87b9b771c2819d7135e5ece357611da3074aa6fce8ed93093b2e55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 397710347e87b9b771c2819d7135e5ece357611da3074aa6fce8ed93093b2e55
SHA3-384 hash: 414fb0a400237a8f78804081c7a0e6788fa2e872491bbe47fa839d21389e44b57f394a5954e4cd2bb99aa96ac3a395e3
SHA1 hash: 5dcee554f21a09516354b9f568b434fbf0c94f3a
MD5 hash: 74f465f54f8649b7aeec81dd2e23b88a
humanhash: nitrogen-twelve-magnesium-cat
File name:REVISED INVOICE.GZ
Download: download sample
Signature Loki
Create hunting rule
File size:310'444 bytes
First seen:2020-06-03 10:56:20 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:rDWFt5nUwka6Y2G/35Wf5zDkz+k6wa4EaLC77dmG:enpL6k52zYpEr7dH
TLSH 94642356036A283594555FF229C806CD62500AB4D2FAA8835FB2ECF6372CFDB73EC552
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: redafire.com
Sending IP: 78.129.132.85
From: SEMAX <Hussam.AlZaaim@redafire.com>
Subject: REVISED INVOICE
Attachment: REVISED INVOICE.GZ (contains "REVISED INVOICE.bat")

Loki C2:
http://mecharnise.ir/da13/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 11:37:32 UTC
File Type:
Binary (Archive)
Extracted files:
296
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hf3rand6q643o4ocqgoxcnpf5trvoyi5umduvjx45dwzgcj3fzkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 397710347e87b9b771c2819d7135e5ece357611da3074aa6fce8ed93093b2e55

(this sample)

Loki

Executable exe 08f05664f89211f11a0d1d4f7103eb81e7edd6f1f527754d4dfd2c95915395c0

  
Dropping
MD5 0fa4c2d4dac9c03967fd8035cfab9152
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 08f05664f89211f11a0d1d4f7103eb81e7edd6f1f527754d4dfd2c95915395c0

Comments