MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b56a043cfbecbbe7e9e44e087611ab188feb373f34983c34ab9081b8dba05ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b56a043cfbecbbe7e9e44e087611ab188feb373f34983c34ab9081b8dba05ed
SHA3-384 hash: a4c4c41402f8b165f7d44ec8fb549107910bfcd74e188d62c0718187899902839f81dbba6d4a008e567fe1085c2c88b4
SHA1 hash: 521211b5398292adc4644a0ee5c89d8f14f25e2e
MD5 hash: f977094edc9eff242cc8e92c289d6073
humanhash: mike-arkansas-four-enemy
File name:Scan_Doc_pdf.arj
Download: download sample
Signature Loki
Create hunting rule
File size:833'001 bytes
First seen:2020-05-11 08:20:30 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:xt4tCI/lmVFzSfLI25f9CQkUig4JZ95hsm/Gwju8k:gtz49STjhziR95ymm8k
TLSH 4205335963F794BA0BF82A6DD5289E13845BA5B00CD4D90B8E1CF05FC2924D9E4B7FC8
Reporter abuse_ch
Tags:arj Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: m2.hs9.in
Sending IP: 192.249.121.194
From: qa.enald <purchase@shpl.com>
Subject: SCAN DOCUMENT
Attachment: Scan_Doc_pdf.arj (contains "Scan_Doc_pdf.exe")

Loki C2:
http://attlogistics-vn.com/first/chief2/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22774.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 08:36:37 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hnlkaq6px3f347u6itqioyi2wgep5m3t6neyhq2kxeebxdn2axwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 3b56a043cfbecbbe7e9e44e087611ab188feb373f34983c34ab9081b8dba05ed

(this sample)

Loki

Executable exe 79129af7eeae9ebb06e1e77ceb732e24565771282c1381b15a3f19721936b84c

  
Dropping
MD5 a7dcee077701d97ff5033795462f611c
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 79129af7eeae9ebb06e1e77ceb732e24565771282c1381b15a3f19721936b84c

Comments