MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52e6074788d1445147baafb2d2d238e95cdfbabf5d02ab9967fd6f34d1c7d321. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52e6074788d1445147baafb2d2d238e95cdfbabf5d02ab9967fd6f34d1c7d321
SHA3-384 hash: 7e4aef04c7570d8e5725c4c2b48b4fe5191d1961aa5d8b18296522f1e30d889a55c9673d051e8ab4780885d775343643
SHA1 hash: 3152b8b961776586a702ebcc23862310a27baa84
MD5 hash: 5eed8c2360ca09e30019df756ba40746
humanhash: red-delaware-venus-charlie
File name:TRF_888_PDF.arj
Download: download sample
Signature Loki
Create hunting rule
File size:380'984 bytes
First seen:2020-04-01 12:24:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:rli4TqaYJZlQewePKcGhZ20yUw1fHoAyEtjyg7h+/+IWSM8dTZDTO88B:NYTiV2GhZ3w1Hny3g7h+pTF6jB
TLSH 448423C0DB8592768EE26D0685821A263E65F4D2716700CD20C7E5F9B5133A6A3DBFE3
Reporter abuse_ch
Tags:arj COVID-19 Loki


Avatar
abuse_ch
COVID-19 themed malspam distributing Loki:

HELO: fake.com
Sending IP: 89.40.114.225
From: finance2 <thiel@cedarpoint.com>
Subject: Delay of Payment due to COVID-19
Attachment: TRF_888_PDF.arj (contains "TRF_888_PDF.exe")

Loki C2:
hXXp://englee-sg.com/canna/five/fre.php

... resolves to 91.215.169.51 (Best-Hoster Group Co. Ltd., Russia)

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-01 17:18:35 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kltaor4i2fcfcr52v6znfury5fon7ov7lubkxglh7vxtjuoh2mqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 52e6074788d1445147baafb2d2d238e95cdfbabf5d02ab9967fd6f34d1c7d321

(this sample)

Loki

Executable exe c13ea6a143a126c21c810ee7860b890cb099f9be17b656d5d84eb98c195deaa3

  
Dropping
MD5 b8d6a631ce52b7ccca58f12188ee5770
  
Dropping
SHA256 c13ea6a143a126c21c810ee7860b890cb099f9be17b656d5d84eb98c195deaa3
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c13ea6a143a126c21c810ee7860b890cb099f9be17b656d5d84eb98c195deaa3

Comments