MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fc1a838f6dd9db2fe073672675a174123a3d6daa2bda35e84604738b68d7733. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4fc1a838f6dd9db2fe073672675a174123a3d6daa2bda35e84604738b68d7733
SHA3-384 hash: 3744e4a3bc40ae787560965377aa45bf3614e1d0a94d2574573fbe3677a6a0236df4c5864d2779e4289fafc8eb537d86
SHA1 hash: 5b10a3cc6b361b00583b47f82957c27c2c2d6392
MD5 hash: 026bfa65942bff65a4c2822dd065e5f7
humanhash: bravo-summer-jupiter-two
File name:Scan_Copy_10272020_PDF.gz
Download: download sample
Signature Loki
Create hunting rule
File size:351'379 bytes
First seen:2020-10-27 13:06:06 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:+TV5f90nNheKV03w4XkhYdLydViTuLA/DvZ1ghUL0jhoKeVqDWkg3kLA:8/90NheKVr4UhRitvcfo3V/JU0
TLSH 7F7423D6A0DBEB6A941E391CF3448FEF04A8115956E431B1392D33F4792C6E07AE478B
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: webmail.indarico.it
Sending IP: 81.29.203.198
From: Accounts <delawar.bakht@betsbd.com>
Subject: Payment Transfer Information for PI
Attachment: Scan_Copy_10272020_PDF.gz (contains "Scan_Copy_10272020_PDF.exe")

Loki C2:
http://qataracfridgerepaire.com/wp-includes/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4fc1a838f6dd9db2fe073672675a174123a3d6daa2bda35e84604738b68d7733/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 08:39:46 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j7a2qohw3wo3f7qhgzzgowqxier2hvw2uk62gxuembdtrnuno4zq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4fc1a838f6dd9db2fe073672675a174123a3d6daa2bda35e84604738b68d7733

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 4fc1a838f6dd9db2fe073672675a174123a3d6daa2bda35e84604738b68d7733

(this sample)

Loki

Executable exe ff5916d20ad9a30d27859f459cd5ffc7648826bbab38076f0a1ba36cff701b8a

  
Dropping
MD5 190841161c7322d61f3e179ef02f5d92
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ff5916d20ad9a30d27859f459cd5ffc7648826bbab38076f0a1ba36cff701b8a

Comments