MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56fd10a423c3f1647473b93d56fa0273626c4f30053d1159a0de5bf7011c5569. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56fd10a423c3f1647473b93d56fa0273626c4f30053d1159a0de5bf7011c5569
SHA3-384 hash: 0495584799c8cb07a3f930f6f333f633e1fb1cb9ea15661fe5eaec56959721b34acb435032062f4b7cec827bf0c1a8f3
SHA1 hash: 2d0a8eeb2f474640b2a2ab8e0233cd39b6a11abf
MD5 hash: 83d68c6f6c26befb3c683f77136865ae
humanhash: jig-hot-alabama-whiskey
File name:DHL Bill of Lading.zip
Download: download sample
Signature Loki
Create hunting rule
File size:710'868 bytes
First seen:2020-05-13 06:13:14 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:FR0bfA7/dJk0wVyOFDBp5I4mm/iTO+xyn7D8hIz/PnD9xpQJXAgZzbfO0GgD54+V:PldJk0wVyOFEofn7IyPpqwgJLXGJ+V
TLSH 1DE423A08E5EBBEC5D02BC5825FA21D9F57AB7C2B6D80F0D41AB61F040BC2745D98B25
Reporter abuse_ch
Tags:DHL Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: pyme75.pymedns.net
Sending IP: 186.64.116.76
From: pvelasquez@warike.pe
Subject: DHL: Please crosscheck delivery details
Attachment: DHL Bill of Lading.zip (contains "DHL Bill of Lading.exe")

Loki C2:
http://mecharnise.ir/da4/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 06:36:59 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k36rbjbdypywi5dtxe6vn6qconrgytzqau6rcwna3zn7oai4kvuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 56fd10a423c3f1647473b93d56fa0273626c4f30053d1159a0de5bf7011c5569

(this sample)

Loki

Executable exe 74fec3ab0741be490ea78a0e85543f56d84909d7e6c1a808fa3b1bb5b0cc2758

  
Dropping
MD5 6ec265259413175cdf5f009f74e3e6ec
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 74fec3ab0741be490ea78a0e85543f56d84909d7e6c1a808fa3b1bb5b0cc2758

Comments