MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46e8506bf6e56bd0ad6b36941aa4aacfb5f9c62c38936f47aa5b7121d16cabe0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46e8506bf6e56bd0ad6b36941aa4aacfb5f9c62c38936f47aa5b7121d16cabe0
SHA3-384 hash: 8eb7d82bb37ff10227b89d540dbbb12736547a4114034a46a416338ce71270226f1892d72e7e518caac3502cba297cb8
SHA1 hash: 5a617dff66f8fd07a6ae96361c83cbaecf7a5cf0
MD5 hash: 52577cc1926fa9fd9eaaae9c360dc577
humanhash: eleven-salami-charlie-grey
File name:Shipment Documents.rar
Download: download sample
Signature Loki
Create hunting rule
File size:144'268 bytes
First seen:2020-10-06 18:10:47 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:0glfp97PNqGuY7qadHzR/55aLb0sYAJLNxVZ9:v7PNzuY2adHzx55GbnNLNvT
TLSH 1BE312D6EDDF2E459DEAE5CE88015DBFE0299430E9E21426D4B1C8D7BC60A2C1CB345B
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.bengiamein.ga
Sending IP: 5.8.93.187
From: kingsley@bengiamein.ga
Subject: RE: Shipment Documents
Attachment: Shipment Documents.rar (contains "Shipment Documents.exe")

Loki C2:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/46e8506bf6e56bd0ad6b36941aa4aacfb5f9c62c38936f47aa5b7121d16cabe0/
Threat name:
ByteCode-MSIL.Infostealer.CoinStealer
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 11:12:52 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i3ufa27w4vv5blllg2kbvjfkz627trrmhcjw6r5klnysdulmvpqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/46e8506bf6e56bd0ad6b36941aa4aacfb5f9c62c38936f47aa5b7121d16cabe0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 46e8506bf6e56bd0ad6b36941aa4aacfb5f9c62c38936f47aa5b7121d16cabe0

(this sample)

Loki

Executable exe eb3f9e33686ca1ff7ea50e18303b97a19ed46d985f91d20dca5b4c2aadf45f24

  
Dropping
MD5 e50c59a2d4c7833463f9e5615df86de8
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eb3f9e33686ca1ff7ea50e18303b97a19ed46d985f91d20dca5b4c2aadf45f24

Comments