MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51ea3ce35fa2b64eebff6da8004097d1b4f5fedc925221802c17c7b38f1acadd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51ea3ce35fa2b64eebff6da8004097d1b4f5fedc925221802c17c7b38f1acadd
SHA3-384 hash: 89e9706cb2cb22fb9c36b74a1c0410557844a04ae7eb7ca8b6b9ce5e0844092b791d141342e9d60b18b620664fc0755e
SHA1 hash: 402b7acabcee04f703264a986bd98589b6a25b2d
MD5 hash: a7378ff4f0dd69d223abe638094a9251
humanhash: idaho-sweet-alanine-sodium
File name:copy-510300_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:355'523 bytes
First seen:2020-05-19 06:01:41 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Kqfrg/w+MYuHPlTsVRH2Wrv6C+jfd8JTKu7OZlnMfy/XMwLzn1U8rLatJnmbt6:Hfk/wwuHPU2Wrv6CSfdQTKXnMfyzznSZ
TLSH 0C74234919422EB7BE66003740F2D34CEF7674D0D966BEC63996CC9A6A073C77A341E8
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: pharoahsmarine.com
Sending IP: 103.139.45.114
From: fsi01@pharoahsmarine.com
Subject: Payment Advice
Attachment: copy-510300_pdf.gz (contains "copy-510300_pdf.exe")

Loki C2:
http://broken10.cf/L5/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.BehavesLike.Win32.AdwareDealPly.bc.5405.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 19:07:00 UTC
File Type:
Binary (Archive)
Extracted files:
288
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=khvdzy27uk3e5277nwuaaqex2g2pl7w4sjjcdabmc7d3hdy2zloq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 51ea3ce35fa2b64eebff6da8004097d1b4f5fedc925221802c17c7b38f1acadd

(this sample)

Loki

Executable exe f13f1f154277188a99010d0d1490915ab377acfcfb0d4e0d56c4511f8c0ce465

  
Dropping
MD5 e9dd5098089ffd590f1515d5661cd190
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f13f1f154277188a99010d0d1490915ab377acfcfb0d4e0d56c4511f8c0ce465

Comments