MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46e367567a92a5ce0cbd7d27ebe39f53851ff16fda32e0df55103cedd651a2b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46e367567a92a5ce0cbd7d27ebe39f53851ff16fda32e0df55103cedd651a2b7
SHA3-384 hash: 0302e7e3d1890f9e14d2d4e902ae2022ef036b46efaa8f2aa1c8d69692b14ce5ba10899a2b4efaef62df2ee2c7fde20f
SHA1 hash: 95e229c02a4a356da022bad148b7a192b7e97490
MD5 hash: d79f1d92ea6e89c472d4e69036266b03
humanhash: blossom-dakota-stairway-apart
File name:Tracking No_SINI0068206497.gz
Download: download sample
Signature Loki
Create hunting rule
File size:137'433 bytes
First seen:2020-12-08 08:00:30 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 3072:6yhnQyrCiOBf4NNM35eVh05g9oUmp9ERaiA+QL6nBumQNYpR:6SQyrCiOBf8Uu6Ovg9ERC+QenBBQqR
TLSH D7D3127CD38A46D7614A659B71303E4326B01A4F9EAFAC2D35F8F505DB6C90A93E3324
Reporter abuse_ch
Tags:DHL gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: slot0.medoche.gq
Sending IP: 173.82.153.156
From: DHL EXPRESS <info@medoche.gq>
Reply-To: katharina.daehn@enserv.org
Subject: DHL PO1001910 Sample Arrive : Tracking No_SINI0068206497
Attachment: Tracking No_SINI0068206497.gz (contains "Tracking No_SINI0068206497.exe")

Loki C2:
http://198.44.96.228/GulDeRBellENoBEAcHIEveMEnt/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.11721.32710.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/46e367567a92a5ce0cbd7d27ebe39f53851ff16fda32e0df55103cedd651a2b7/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-12-08 08:01:07 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i3rwovt2sks44df5put6xy47kocr74lp3izobx2vca6o3vsruk3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/46e367567a92a5ce0cbd7d27ebe39f53851ff16fda32e0df55103cedd651a2b7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 46e367567a92a5ce0cbd7d27ebe39f53851ff16fda32e0df55103cedd651a2b7

(this sample)

Loki

Executable exe 66c74124948ce2c867920fe821be6e622a55627813a66c6b8d1d1e425b469215

  
Dropping
MD5 67789799f0ac4fb488094a03efe75862
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 66c74124948ce2c867920fe821be6e622a55627813a66c6b8d1d1e425b469215

Comments