MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3cfb5f1433628ed735290ef23d3ec99ba695f3d4068bec8d1ca8560659165805. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3cfb5f1433628ed735290ef23d3ec99ba695f3d4068bec8d1ca8560659165805
SHA3-384 hash: 4b901f35fbf37c6ef0a71e215f302cab4d1be32867d0a5c3a5af7084c64bfba3f6c0998908239ddb4e41ee0033722971
SHA1 hash: 4a5102dda7555e1582bb045980706da7cc92a2a6
MD5 hash: fdb2326e9c14de0a77e8c7c4f77cd3b7
humanhash: mars-pluto-wisconsin-winner
File name:a6ee0cef-da86-34e6-9626.gz
Download: download sample
Signature Loki
Create hunting rule
File size:605'136 bytes
First seen:2020-10-13 05:42:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:I3vcVXAF9qoMzyfi8edAtMUgKyCEcQWGvV:IQQ2e6FmKcsvV
TLSH 1CD4233C64AAD969F4A093BBF78913406D9964127DE65CB10201FFCEC379B3A08F7991
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.coreforintl.ml
Sending IP: 107.175.115.40
From: qatar_logistics <qatar_logistics@coreforintl.ml>
Subject: Re: **TOP URGENT** BL Draft Copy
Attachment: a6ee0cef-da86-34e6-9626.gz (contains "a6ee0cef-da86-34e6-9626.exe")

Loki C2:
http://cadject.pw/officem1/logs/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.21240.23314.31681.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3cfb5f1433628ed735290ef23d3ec99ba695f3d4068bec8d1ca8560659165805/
Threat name:
ByteCode-MSIL.Spyware.BtcWare
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 01:47:35 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ht5v6fbtmkhnonjjb3zd2pwjtotjl46ua2f6zdi4vblamwiwlacq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/3cfb5f1433628ed735290ef23d3ec99ba695f3d4068bec8d1ca8560659165805

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 3cfb5f1433628ed735290ef23d3ec99ba695f3d4068bec8d1ca8560659165805

(this sample)

Loki

Executable exe 3b62f6df8fd191bcfeadb11e9db80286925b1022deb0b5baf7d044faeb648b5b

  
Dropping
MD5 159cad2b48f7f763983fbd6f9a1a0c57
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3b62f6df8fd191bcfeadb11e9db80286925b1022deb0b5baf7d044faeb648b5b

Comments