MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e735eb40131c712892110f060461505fea1103f6b85ce50f2c90b6f65ca3661. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e735eb40131c712892110f060461505fea1103f6b85ce50f2c90b6f65ca3661
SHA3-384 hash: e91af1e26bf984faf2cfa4450009e583d90efb4b5f87a3277923569590b3ac58588cbd4d3a0d2b94ec72506fc844307b
SHA1 hash: 18eaf017e188d89674d682b335604d965d5fdcc6
MD5 hash: da0b853b7ff36dfd5f3c4786f1e86ecc
humanhash: carpet-low-ack-oregon
File name:INQUIRY.r01
Download: download sample
Signature Loki
Create hunting rule
File size:318'589 bytes
First seen:2020-10-20 08:17:06 UTC
Last seen:Never
File type: r01
MIME type:application/x-rar
ssdeep 6144:VplD6rUxzqDpdZoYDt0j/w9amVKigJSm98C+q/C/EpnGm+cXDJwXJasbKVEc:TlD6rUUDXZvzFAL5C/00cXWXJ/O
TLSH A06423476D70970CE5A69377188CCB703F46E0C461468AAF9A489F06DAE3DA363DED34
Reporter abuse_ch
Tags:Loki r01


Avatar
abuse_ch
Malspam distributing Loki:

HELO: multiimpact.com.my
Sending IP: 192.236.146.195
From: MS ATIKAH <sales@multiimpact.com.my>
Subject: Re: MULTI-IMPACT/INQUIRY ORDER
Attachment: INQUIRY.r01 (contains "INQUIRY.exe")

Loki C2:
http://mecharnise.ir/eb2/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5e735eb40131c712892110f060461505fea1103f6b85ce50f2c90b6f65ca3661/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 06:26:01 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lzzv5nabghdrfcjbcdygarqvax7kceb7noc44uhszefw6zokgzqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5e735eb40131c712892110f060461505fea1103f6b85ce50f2c90b6f65ca3661

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

r01 5e735eb40131c712892110f060461505fea1103f6b85ce50f2c90b6f65ca3661

(this sample)

Loki

Executable exe 9c355f67f51dabe24a8cd0374af99c91b2d04a5bb26892f3a92eced0f832b35d

  
Dropping
MD5 803e00b7859763aa8ed80d64017358dc
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9c355f67f51dabe24a8cd0374af99c91b2d04a5bb26892f3a92eced0f832b35d

Comments