MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 679db2eab0a36c8ea3edb186c1602f65723840ed8587073604139aa9399e4073. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 679db2eab0a36c8ea3edb186c1602f65723840ed8587073604139aa9399e4073
SHA3-384 hash: 9f5e22188717e05066b8ed63257f589584692484b84d597d6f5eecc9527a502abd781c513fb9f142628bdc6ff5b5d6d4
SHA1 hash: 348365b9c4140c3cafea4b81ad239e0e419c48fe
MD5 hash: b543cd2a939a3233ab82ba1a61e0a6bf
humanhash: georgia-montana-steak-pizza
File name:SWIFT Transfer 103 049FT01192200001.zip
Download: download sample
Signature Loki
Create hunting rule
File size:434'164 bytes
First seen:2020-10-22 07:46:13 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:IPeuoR1SMM9jp8KQcI7em8pK5roun+y+8HhLIQGDS5:IG/L+3Q2m8ppQHuQGq
TLSH 779423403E375B6643927AD22FF16415A29EC78D33F3F2E108641E076725F385AACE69
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: ninecoast.cn
Sending IP: 83.149.106.5
From: 陈龙 Tony Chen<tony.chen@ninecoast.cn>
Subject: Re: Ninecoast Fwd: SWIFT Transfer (103) 049FT01192200001
Attachment: SWIFT Transfer 103 049FT01192200001.zip (contains "SWIFT Transfer (103) 049FT01192200001.exe")

Loki C2:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/679db2eab0a36c8ea3edb186c1602f65723840ed8587073604139aa9399e4073/
Threat name:
Win32.Trojan.LokibotCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 03:34:41 UTC
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m6o3f2vqunwi5i7nwgdmcybpmvzdqqhnqwdqonqeconksom6ibzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 679db2eab0a36c8ea3edb186c1602f65723840ed8587073604139aa9399e4073

(this sample)

Loki

Executable exe eacb94bc4e6787b189268b8c2bd1be331ddc77e310a57ca718d196c3f0063acf

  
Dropping
MD5 af23ce2e84c76762ccc948c80291f0dd
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eacb94bc4e6787b189268b8c2bd1be331ddc77e310a57ca718d196c3f0063acf

Comments