MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61c64890fd15b77e5bcf339a4231466d0939fac7be58a68c2bffa30c366873f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61c64890fd15b77e5bcf339a4231466d0939fac7be58a68c2bffa30c366873f9
SHA3-384 hash: 9efabd7059f1fd1efcebe4571710e47d51cf09f692738921168d4ab3b0a938619dd57a85b3909deeffa8fffbe52ac375
SHA1 hash: a61cb826792c82446ba1fbd798e35925fece4e1e
MD5 hash: 780e828b0b3fee65623f88ab78a4e2ad
humanhash: hot-ink-september-pip
File name:DHL FILE 267382.rar
Download: download sample
Signature Loki
Create hunting rule
File size:307'306 bytes
First seen:2020-10-18 06:32:14 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:PVXgRHddS/8iF4LIJK65cgPYZkxRJ5OgFNF42o6snJRvPpR1Xah:PVidYkhLIS8xRJ5Ogl4jfjqh
TLSH BB6423D4E124F1A716E250B45A6F908D7976C5A1EE60FED843775E8C3323BF218BA311
Reporter abuse_ch
Tags:DHL Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server.filmworld.tv
Sending IP: 70.32.31.17
From: DHL Express <dhlSender@dhl.com>
Reply-To: DHL Express <dhlSender@dhl.com>
Subject: DHL On Demand Delivery
Attachment: DHL FILE 267382.rar (contains "DHL FILE 267382.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
139
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61c64890fd15b77e5bcf339a4231466d0939fac7be58a68c2bffa30c366873f9/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mhdereh5cw3x4w6pgoneemkgnuett6whxzmkndbl76rqyntiop4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/61c64890fd15b77e5bcf339a4231466d0939fac7be58a68c2bffa30c366873f9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 61c64890fd15b77e5bcf339a4231466d0939fac7be58a68c2bffa30c366873f9

(this sample)

Loki

Executable exe 0969f9b67bae5ccaa7d4b2fd6fa97a6f6accbc890711f6f3f9361302d9e832c4

  
Dropping
MD5 72fb9a400177dfd9b010ed127537fe3e
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0969f9b67bae5ccaa7d4b2fd6fa97a6f6accbc890711f6f3f9361302d9e832c4

Comments