MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a3e74c5b52d1cf2308a276952f92c2954a7f6ad064d18334ef0129dd4dd4829. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a3e74c5b52d1cf2308a276952f92c2954a7f6ad064d18334ef0129dd4dd4829
SHA3-384 hash: 2d18b5bd2594cdcb2d908e03d46b468beb9e2af9ae8b10b2eea1ab0fe9105d8759826d9d3f89bf3c08b381060229b766
SHA1 hash: 371b56628d337b8e4a81ec9262a8b5bfee59b0ba
MD5 hash: f4b0c78955a6a251684359513aea6739
humanhash: seventeen-harry-six-happy
File name:Proforma Invoice.Pdf.rar
Download: download sample
Signature Loki
Create hunting rule
File size:395'605 bytes
First seen:2020-12-22 10:21:37 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:FU+qXUj1LPHsT408aGM+N1Obnvs4qOS+l7k:FLqXUFHsT4jv1sbvl9l7k
TLSH 148423E87CA5D495AE35480FE006892A763FEEB7BACCC456D921C77CD3B84292E0F415
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: se6r-iad1.servconfig.com
Sending IP: 173.231.242.8
From: Emma hallen <Emmah@sianwholesale.com>
Subject: 【Proforma Invoice & Shipping Schedule】
Attachment: Proforma Invoice.Pdf.rar (contains "Q7QE40EiLEt9UeN.exe")

Loki C2:
http://azzmtool.com/kin/kin1/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
182
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Porcupine.MSIL.GenKryptik.EYLO.98982.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3a3e74c5b52d1cf2308a276952f92c2954a7f6ad064d18334ef0129dd4dd4829/
Threat name:
ByteCode-MSIL.Trojan.StealerPacker
Create hunting rule
Status:
Malicious
First seen:
2020-12-15 08:22:07 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hi7hjrnvfuopemeke5uvf6jmffkkp5vnazgrqm2o6ajj3vg5jauq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3a3e74c5b52d1cf2308a276952f92c2954a7f6ad064d18334ef0129dd4dd4829

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 3a3e74c5b52d1cf2308a276952f92c2954a7f6ad064d18334ef0129dd4dd4829

(this sample)

Loki

Executable exe e6633b5015cad9d0a683b91202358e01f0e568e1a5f333f0ffbc5b4e3e8b1fb8

  
Dropping
MD5 959f4045a890e3de2c9ba5f1ff60cc33
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e6633b5015cad9d0a683b91202358e01f0e568e1a5f333f0ffbc5b4e3e8b1fb8

Comments