MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6705d1b4a2fad17be50301c5dfc195e7fb496378c688354d12a5e08d45dae07d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6705d1b4a2fad17be50301c5dfc195e7fb496378c688354d12a5e08d45dae07d
SHA3-384 hash: 64443613e6d35d36265a0f3ca78f4e4b70df443723a3d9a0f198b93228d745e9ea692d225e67cfad9d6cae514991cc44
SHA1 hash: 3e89aaa4fc41c2d1796fbff2437f271b7edea268
MD5 hash: f887d5cea5c1ce93fdc9ce2b72cc2b4e
humanhash: william-foxtrot-november-table
File name:BKG PNPN203746.xls.zip
Download: download sample
Signature Loki
Create hunting rule
File size:366'925 bytes
First seen:2020-06-17 18:14:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:W8LuHMobnZjncB35dzFF/pvVPWN5gfdsfEYUbaRA56nL3WSHXuq:W8itG3vRF/pteTgY1q35kL3bHXf
TLSH D0742301F017C2AE531D6D23E731A564C29626FB22ACF6E4A5609905FFE2F07DDAC706
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: uapcu.org
Sending IP: 95.211.208.25
From: Vicheth <info1@uapcu.org>
Subject: RE: BOOKING PNH FOR ETD 21-JUNE-2020 BKG# PNPN203746
Attachment: BKG PNPN203746.xls.zip (contains "BKG# PNPN203746.xls.exe")

Loki C2:
http://sandeephiremath.com/wp_admin/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Variant.Zusy.306784.5378.28867.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25511.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Gathering data
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m4c5dnfc7lixxzidahc57qmv475usy3yy2edktisuxqi2ro24b6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 6705d1b4a2fad17be50301c5dfc195e7fb496378c688354d12a5e08d45dae07d

(this sample)

Loki

Executable exe 13b8c5ee8e938377dec54d8026e8545e0ce5e1d6a3c80b8ae82ea4840a949e34

  
Dropping
MD5 6ec1df16eb435a7fd7a93eae00bee421
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 13b8c5ee8e938377dec54d8026e8545e0ce5e1d6a3c80b8ae82ea4840a949e34

Comments