MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e9935dfec93c7fe1719d955130a5ae3a0c6448c287ca23e116e3cee83e7cb9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e9935dfec93c7fe1719d955130a5ae3a0c6448c287ca23e116e3cee83e7cb9e
SHA3-384 hash: 79f361de26416da9a6dea1403bdddc3f8770c12b7d757fd64724e2530007b2a8cf33fd186f48f878f35fc08852bce612
SHA1 hash: a321e606d4ae50cad7d64a3410a18e3b5f157ce1
MD5 hash: 0e9fd893a298fcf339bb41cecb590e82
humanhash: asparagus-carpet-iowa-nineteen
File name:December Order Request.rar
Download: download sample
Signature Loki
Create hunting rule
File size:397'110 bytes
First seen:2020-12-22 12:38:29 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:COjxJsPBrLxhRdEqsjRVGLjagfQypZgBpJiOVc8GIfjILAnErEFK+oP9UEqibf:COFepb63EgBp7Vc8CUE4FAP9U5iD
TLSH 578423243F9C697C5E22A48EF9622F9F1F99FF9806D47B4406D1FE198DCF1906926C20
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: vps.sevoi.eu
Sending IP: 185.203.18.16
From: reema baswel <reema@pincargo.co.nz>
Subject: RE: DECEMBER Order Request
Attachment: December Order Request.rar (contains "HXsdC5xNe0qnMW8.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
179
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.10424.29812.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3e9935dfec93c7fe1719d955130a5ae3a0c6448c287ca23e116e3cee83e7cb9e/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Suspicious
First seen:
2020-12-22 12:39:05 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h2mtlx7mspd74fyz3fkrgcs24oqmmremfb6kepqrny6o5a7hzopa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3e9935dfec93c7fe1719d955130a5ae3a0c6448c287ca23e116e3cee83e7cb9e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 3e9935dfec93c7fe1719d955130a5ae3a0c6448c287ca23e116e3cee83e7cb9e

(this sample)

Loki

Executable exe b10a85a90d2589086e3b7b49a24c67ad05f439284cd998f92f8a900de6794d2a

  
Dropping
MD5 97ccb51370035107b31671986e967e26
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b10a85a90d2589086e3b7b49a24c67ad05f439284cd998f92f8a900de6794d2a

Comments