MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f6cdd8c30448bb9c84a16bad689dc222f1b1b61e183f63030825b999ccf4b15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f6cdd8c30448bb9c84a16bad689dc222f1b1b61e183f63030825b999ccf4b15
SHA3-384 hash: 2884fc2c63e7b9a44eaf717694fb1b1918e18863d94ba2f946fae27ec07e74ab0e25e91654c9ec03d5041a6b00361cf4
SHA1 hash: 2f3836bc551be4d00b18bf900d8595eeee55503e
MD5 hash: b6409aa6ff85113611546888b5e9a45f
humanhash: ceiling-mobile-vegan-louisiana
File name:PURCHASE ORDER.pdf.rar
Download: download sample
Signature Loki
Create hunting rule
File size:309'166 bytes
First seen:2020-12-24 09:25:37 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:92QiZKhWuEaWyUEQleFAoh3Hafi89y7P/VgbP6LkzdCo:kzKou5U055ngbP9zd
TLSH 966423E586379A7850F276638C57C22823EECE8E0178196B0AB1EFB92E1544C5FCF754
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: vps.sevoi.eu
Sending IP: 185.203.18.16
From: YAMATO TRANSPORT <pklang5@yamato.com>
Reply-To: r.laref@transitworldexpress.com, v.kirtskhalia@goldway.com.ge
Subject: SUBMIT PROFOMA INVOICE
Attachment: PURCHASE ORDER.pdf.rar (contains "ZJ6acgnEEcphF6n.exe")

Loki C2:
http://azzmtool.com/kin/kin1/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
420
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.11301.22844.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5f6cdd8c30448bb9c84a16bad689dc222f1b1b61e183f63030825b999ccf4b15/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2020-12-24 09:26:06 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l5wn3dbqisf3tsckc25nnco4eixrwg3b4gb7mmbqqjnzthgpjmkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5f6cdd8c30448bb9c84a16bad689dc222f1b1b61e183f63030825b999ccf4b15

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 5f6cdd8c30448bb9c84a16bad689dc222f1b1b61e183f63030825b999ccf4b15

(this sample)

Loki

Executable exe c844f3484e31450c39372bcc19ebc94bcff258fd03e8a59edf7b3acc3c91682a

  
Dropping
MD5 0d1720971a5e9b59cfaec7984f29ab71
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c844f3484e31450c39372bcc19ebc94bcff258fd03e8a59edf7b3acc3c91682a

Comments