MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53cb7943b2987000fdab66f1762dbe46e24a1d62dbe3bf44a86a37767e302790. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53cb7943b2987000fdab66f1762dbe46e24a1d62dbe3bf44a86a37767e302790
SHA3-384 hash: 99622641938f01dfaaa598aa8ccc207f5cc056f27fa5aa22f4b231e7c080d2cc5093122405aa82343b6261b1f7889ea7
SHA1 hash: fb9a5ac6c96ba8a203cc5de58854930cba6c25bb
MD5 hash: bb40a502500360d004bf50cffbf71c53
humanhash: wisconsin-illinois-berlin-lion
File name:swift copy 06082020_pdf.arj
Download: download sample
Signature Loki
Create hunting rule
File size:415'420 bytes
First seen:2020-08-06 06:53:08 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:zLZ1wLrvpfVMQG+dsGWx3m4VNkgURSrFwzpzqz9y:Dqv/WmsJ24CRiup3
TLSH 8D94234EBFC71129EF58DC4D913A93504A9968772F8127EB22A0E803219BDC4257FFD6
Reporter abuse_ch
Tags:arj Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server1.bluecloud.jo
Sending IP: 81.95.158.149
From: Raisyah (Ms) <raisyaah@trioeagle.com>
Subject: Re: PAYMENT AGAINST DUE INVOICE
Attachment: swift copy 06082020_pdf.arj (contains "INVOICE_392cr.exe")

Loki C2:
http://abjkad.com/zoro/zoro3/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.21146.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/53cb7943b2987000fdab66f1762dbe46e24a1d62dbe3bf44a86a37767e302790/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 04:37:26 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kpfxsq5stbyab7nlm3yxmln6i3reuhlc3pr36rfini3xm7rqe6ia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/53cb7943b2987000fdab66f1762dbe46e24a1d62dbe3bf44a86a37767e302790

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 53cb7943b2987000fdab66f1762dbe46e24a1d62dbe3bf44a86a37767e302790

(this sample)

Loki

Executable exe deda342361cd1141b20eb618083692844fafcfb36af41c000ce9084ce80c8bfd

  
Dropping
MD5 b1ed372bef5de150cc70b36dc05090b5
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 deda342361cd1141b20eb618083692844fafcfb36af41c000ce9084ce80c8bfd

Comments