MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68611a964b2b5bc126cc040db8f5081ee0df16d0a0560eec9b0e1822d7ee6bcc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68611a964b2b5bc126cc040db8f5081ee0df16d0a0560eec9b0e1822d7ee6bcc
SHA3-384 hash: d2f97dab3556568df3c9055f60b86fc2848fc97c438dc8928231bbeefb75a2e05e084dc883978d6af82f85195de7434b
SHA1 hash: 2f4d20fc72c4b8c63f5d84ece54eda38f0a42b26
MD5 hash: 8e099720da4e709a2c5b1e7fb5d66335
humanhash: magazine-red-victor-delaware
File name:2020121005229_scan02_,img.iso
Download: download sample
Signature Loki
Create hunting rule
File size:729'088 bytes
First seen:2020-10-12 05:52:52 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:0AindXhz+XwfE0CQPW7q0dzQNqJHRrUtqwOkNsQrrRmeT:bi16wf9aNzQ4lFUtqx+sQhme
TLSH 98F4AF22E2E17433C1273A3D9CDB576C982EBE503D2869463BE91C4F5F3D6917829293
Reporter abuse_ch
Tags:geo iso ITA Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: vps10224.ervers.com
Sending IP: 185.136.89.140
From: Banco BPM <luca.bott@bancobpm.it>
Subject: Re: bonifici
Attachment: 2020121005229_scan02_,img.iso (contains "2020121005229_scan02_,img.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/68611a964b2b5bc126cc040db8f5081ee0df16d0a0560eec9b0e1822d7ee6bcc/
Threat name:
Win32.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 03:30:20 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nbqrvfslfnn4cjwmaqg3r5iid3qn6fwqubla53e3bymcfv7onpga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/68611a964b2b5bc126cc040db8f5081ee0df16d0a0560eec9b0e1822d7ee6bcc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

iso 68611a964b2b5bc126cc040db8f5081ee0df16d0a0560eec9b0e1822d7ee6bcc

(this sample)

Loki

Executable exe b11dd5b20f65034f4e5d1f6a13019d06a2d26c357d10ee42b9de2f326c72267b

  
Dropping
MD5 6e38d4828ad7c07f7570a42fd004f8cd
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b11dd5b20f65034f4e5d1f6a13019d06a2d26c357d10ee42b9de2f326c72267b

Comments