MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3bf53d0ecca1d567d29f52d9682a615ef53221ff06abfa965c2a06e7c277277f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3bf53d0ecca1d567d29f52d9682a615ef53221ff06abfa965c2a06e7c277277f
SHA3-384 hash: ad354fe6f2ca88aea4cb3926cd8ed788bd8e0780b2627ef4650563fcc1a8bb1669c2085c9f3974132ecf72bc3a3258b2
SHA1 hash: e22613aec3d2376080f75384a021d4ef403d7e97
MD5 hash: 1de961a1f0ca847b9690372f0d432e4c
humanhash: carpet-robin-table-lion
File name:Faktur Bangun Nusa Mandiri.pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:19'269 bytes
First seen:2020-04-29 16:56:52 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 384:1yElsnRDml6gogolQWXaZV9oM8NUFZGKIyiY26077f5LYptY:FuxmagsQeCVv4rKKB6O7f5
TLSH 9882E109D1D43BAE4C1DBA092C08A769873DA224C04F9DFC0B858BED7EAC7AA3D151D5
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: ptmatsuo.co.id
Sending IP: 202.74.72.84
From: Unipower | Jakarta <edy_s@karana.co.id>
Subject: COVID19-PT.UNIPOWER PRATAMA- INVOICE 098/I/IV/20- PO.9100326941
Attachment: Faktur Bangun Nusa Mandiri.pdf.gz (contains "Faktur Bangun Nusa Mandiri.pdf.exe")

Loki C2:
http://theblueprint.vn/th/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ursu.846817.9703.1879.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 17:35:36 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hp2t2dwmuhkwpuu7klmwqktbl32teip7a2v7vfs4fidopqtxe57q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 3bf53d0ecca1d567d29f52d9682a615ef53221ff06abfa965c2a06e7c277277f

(this sample)

Loki

Executable exe 8eb33d0b08f137c3aa3f66d5afe0188b9b60458f95ecf8a2f2ca3815059e2fca

  
Dropping
MD5 19f61575738fdf8a799beba1fca4efa5
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8eb33d0b08f137c3aa3f66d5afe0188b9b60458f95ecf8a2f2ca3815059e2fca

Comments