MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 495e88db7f79e4930611aa0647ee42b806a7112b211546639e16dec2ebbac21b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 495e88db7f79e4930611aa0647ee42b806a7112b211546639e16dec2ebbac21b
SHA3-384 hash: 70ac3ece90b3e869937e7e4ba54e07b133b2e18c768aaaa6f0799c76a5135c23b72871fe854c29cb2f11715d8ede4b10
SHA1 hash: b75e2e2c818eb82ae643296287442ebb2c6e4298
MD5 hash: 07578f047c179095dd7c564c3872cdd6
humanhash: double-uranus-mike-burger
File name:COVID-19 TRANSFER RECEIPT FORM_pdf.arj
Download: download sample
Signature Loki
Create hunting rule
File size:630'900 bytes
First seen:2020-05-12 11:53:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:oF3Jz3sQhry4DHb8Ygr/rvWhOGKBoFKHEcHo0AlXZp:otJz3sQh5DHoVnvjBosE+zAlJp
TLSH 7AD423737A9DE1684A54180FD0DE96C5462AE8BF13420FBFEA04B8209663F1D56FB11E
Reporter abuse_ch
Tags:arj Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: cpshared4.tedata.net
Sending IP: 213.158.187.39
From: accounts@goan-chartering.com
Subject: TRANSFER RECEIPT
Attachment: COVID-19 TRANSFER RECEIPT FORM_pdf.arj (contains "COVID-19 TRANSFER RECEIPT FORM_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.AutoIT-3.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 12:41:59 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
26 of 47 (55.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jfpirw37phsjgbqrvidep3scxadkoejleekumy46c3pmf252yinq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 495e88db7f79e4930611aa0647ee42b806a7112b211546639e16dec2ebbac21b

(this sample)

Loki

Executable exe 2a3c60d816836bf1cecb31f34d4eaf5b93976c123364538d5b8e22e9272e1269

  
Dropping
MD5 1678a6372c11592d92876749482fd18e
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2a3c60d816836bf1cecb31f34d4eaf5b93976c123364538d5b8e22e9272e1269

Comments