MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5caa7440437fbc72abf60075e5d5fc360c567dcf681f9ec02fb145900011938f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5caa7440437fbc72abf60075e5d5fc360c567dcf681f9ec02fb145900011938f
SHA3-384 hash: e34325f398ad577a583b637f757e924e7583bad68a6e0e163791170226c6400f5f569267713de759ffc19113b6534ee2
SHA1 hash: c528417fcda87a9251c8e99524195d2a4c426110
MD5 hash: 2652449495cc9805161ce35befc3a156
humanhash: december-spring-september-fish
File name:1200 line New Cairo Project - Pumps - RFQ - In hand- Urgent.gz
Download: download sample
Signature Loki
Create hunting rule
File size:307'898 bytes
First seen:2020-08-10 11:44:45 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:G84aoG1PBGshZpydYpK1YqV7ENoRsrdT63YwzBcr+YPTO/QpZkmXN:voePBB9yYp5VNHrJwFYboaZkmXN
TLSH CE6423D3F0101E06B8C0676309C5DD4E27BE96C8B67CD64D42EA93BA1B3CC9F445D9A6
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: clean205.mxserver.ro
Sending IP: 176.223.124.55
From: Mohamed Sherif <mohamed.sherif@hassanallam.com>
Subject: 1200 line New Cairo Project - Pumps - RFQ - In hand- Urgent
Attachment: 1200 line New Cairo Project - Pumps - RFQ - In hand- Urgent.gz (contains "1200 line New Cairo Project - Pumps - RFQ - In hand- Urgent.exe")

Loki C2:
http://dorobantul.ro/b4pf/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.ed26fcbe647e0b93.26531.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5caa7440437fbc72abf60075e5d5fc360c567dcf681f9ec02fb145900011938f/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 11:46:08 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lsvhiqcdp66hfk7wab26lvp4gygfm7opnapz5qbpwfczaaarsohq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/5caa7440437fbc72abf60075e5d5fc360c567dcf681f9ec02fb145900011938f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 5caa7440437fbc72abf60075e5d5fc360c567dcf681f9ec02fb145900011938f

(this sample)

Loki

Executable exe 44e32cacf45f4d123ecdee7dcde7f7b3280834aeb576d58fdd0bf78c8028db4c

  
Dropping
MD5 ed26fcbe647e0b93af295e7980459d46
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 44e32cacf45f4d123ecdee7dcde7f7b3280834aeb576d58fdd0bf78c8028db4c

Comments