MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c5e85323d984c3c2f65d679de8b9abf11ea3d7f21e21341272a78ebf1d4f8f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4c5e85323d984c3c2f65d679de8b9abf11ea3d7f21e21341272a78ebf1d4f8f6
SHA3-384 hash: 68b0f5befc1a2cab24cfd5db4840335d475dc6dc802882d61b1b14d51544b37af8e8f50e0a0a2739a6fcb29016960cba
SHA1 hash: e1baf7d3b27db97dd943e967feef737a9cceeacc
MD5 hash: a45cb72a2f689b27f6fa0189ccfa0b68
humanhash: kentucky-muppet-cola-quebec
File name:ЗАПИТВАНЕ ЗА ОФЕРТА 15-10-2020·pdf.exe.zip
Download: download sample
Signature Loki
Create hunting rule
File size:415'835 bytes
First seen:2020-10-16 12:17:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:pqQ7qsa09Rdw7eQ/0BKNHeEVuMMG+crjKUaV1wZZnla0ECeGAAOsbONmvWaZ:p/qjeRdaeSpNHNV+cr2U21I9kpAxCCWA
TLSH CC9423E4E1EB55C30C5E2E12A10BCABC083D1739B90C49CF5AA56DEB9B86189FF74741
Reporter abuse_ch
Tags:BGR geo Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.pgn-perkasa.co.id
Sending IP: 43.231.128.67
From: SOFIA UNIVERSITY ST. KLIMENT OHRIDSKI <admin@uni-sofia.bg>
Subject: ЗАПИТВАНЕ ЗА ОФЕРТА (SOFIA UNIVERSITY ST. KLIMENT OHRIDSKI) EUI894/BG4633
Attachment: ЗАПИТВАНЕ ЗА ОФЕРТА 15-10-2020·pdf.exe.zip (contains "ЗАПИТВАНЕ ЗА ОФЕРТА 15-10-2020·pdf.exe")

Loki C2:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.BackDoor.SpyBotNET.25.21088.18222.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4c5e85323d984c3c2f65d679de8b9abf11ea3d7f21e21341272a78ebf1d4f8f6/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 01:01:52 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jrpikmr5tbgdyl3f2z455c42x4i6upl7ehrbgqjhfj4ox4ou7d3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4c5e85323d984c3c2f65d679de8b9abf11ea3d7f21e21341272a78ebf1d4f8f6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 4c5e85323d984c3c2f65d679de8b9abf11ea3d7f21e21341272a78ebf1d4f8f6

(this sample)

Loki

Executable exe 5f3502af1c8963213f66cc87f0078d5740a813918fe957981c8148747448a055

  
Dropping
MD5 614b2524503820715746f7f0741126a2
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5f3502af1c8963213f66cc87f0078d5740a813918fe957981c8148747448a055

Comments