MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55489e0c97b7c267b6cea0906d0690612cd1dde8721ebb8b28b5a46e8596ef56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 55489e0c97b7c267b6cea0906d0690612cd1dde8721ebb8b28b5a46e8596ef56
SHA3-384 hash: ae732c53a1289f2bcc35c55c8273e726f076328dd1087193b91c1063c2cf07be7cd18f148b654eb912f3c43e7769cec5
SHA1 hash: 49274e039543965978834774212b20093166243c
MD5 hash: a31797ede833009e13ab942547c14cbe
humanhash: artist-spring-mountain-yellow
File name:ES_MSC-20024169(BL DRAFT) .pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:383'758 bytes
First seen:2020-11-13 16:46:11 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:37lca7etD5boCvLLB4HqXFhsaSODtkqoT3XuzqIQksScqzr360xFgatpoLNUl:3qZtoCxTXgc7YjZcr3NgeOhE
TLSH 408423E62D205021DA00603AEBD7F569E83BCD45887F54ABA45DF354FBC2602DFAF0A0
Reporter fabjer
Tags:archive

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/55489e0c97b7c267b6cea0906d0690612cd1dde8721ebb8b28b5a46e8596ef56/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-13 14:23:07 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kvej4dexw7bgpnwoucig2buqmewndxpioiplxcziwwsg5bmw55la._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 55489e0c97b7c267b6cea0906d0690612cd1dde8721ebb8b28b5a46e8596ef56

(this sample)

Loki

Executable exe ebd9ff44f33949f0e6e78c04d449ca382947b636e7dda056df753ae2ed0661d7

  
Dropping
SHA256 ebd9ff44f33949f0e6e78c04d449ca382947b636e7dda056df753ae2ed0661d7
  
Delivery method
Distributed via e-mail attachment

Comments