MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3aa9bf8025d7a37704494871dc3e06ecc2e5c8448f8ec2a79e3ea15d77380fe5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3aa9bf8025d7a37704494871dc3e06ecc2e5c8448f8ec2a79e3ea15d77380fe5
SHA3-384 hash: c54c5b4ea4cda454701db1db78ad3cf58015c2daa670c8a1569a9d946c89c379588d5e9afcf75be7215ee05bbd798879
SHA1 hash: 51e8ec98473dfceac3d229e4a224041a600090b3
MD5 hash: 8107b95f77a35f959238046e8ee2845b
humanhash: mike-london-south-wolfram
File name:BSL SOA 2020.rar
Download: download sample
Signature Loki
Create hunting rule
File size:533'711 bytes
First seen:2020-12-14 08:34:18 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:KxrXax8hTHL6WZysIbYCyt80LcJbRlgHUwb1N6P:KtnH2WZjCy4JPajb1N6P
TLSH 27B423372E3144D77A08BD8A3C455FA62820EEE1367290B591EDB99B417480FD87BE72
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: vps.sevoi.eu
Sending IP: 185.203.18.16
From: Linda Bsl <linda@bsllogistic.com>
Reply-To: Linda Bsl <belisarsales@gmail.com>, Linda Bsl <belisarsales@gmail.com>
Subject: RE: SOA 12-2020 BSL LOGISTICS
Attachment: BSL SOA 2020.rar (contains "q7871MC4vpCBSzj.exe")

Loki C2:
http://azzmtool.com/kin/kin1/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Porcupine.MSIL.GenKryptik.EYJM.98961.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3aa9bf8025d7a37704494871dc3e06ecc2e5c8448f8ec2a79e3ea15d77380fe5/
Threat name:
ByteCode-MSIL.Trojan.DarkStealPacker
Create hunting rule
Status:
Malicious
First seen:
2020-12-14 07:41:36 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hku37abf26rxobcjjby5ypqg5tbolscer6hmfj46h2qv25zyb7sq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3aa9bf8025d7a37704494871dc3e06ecc2e5c8448f8ec2a79e3ea15d77380fe5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 3aa9bf8025d7a37704494871dc3e06ecc2e5c8448f8ec2a79e3ea15d77380fe5

(this sample)

Loki

Executable exe e4e21476bcd9bbf6c6a039b8a19383dcd16c77d32f7934a95793d91219bad2f7

  
Dropping
MD5 9219f76eb2eba7e822d55498847a7ca2
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e4e21476bcd9bbf6c6a039b8a19383dcd16c77d32f7934a95793d91219bad2f7

Comments