MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68f94c06e27dc332ff6b320739b51110481f0795d13807b12ec69d7ef6cf4315. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68f94c06e27dc332ff6b320739b51110481f0795d13807b12ec69d7ef6cf4315
SHA3-384 hash: 8049f155b986068c71d7ae364fa9f0ceebb80fc221782dafa4bf50bb659fe3be4a71fcb58a3d28a6fab99d300f07296a
SHA1 hash: 50694c5e18c01298443641a1761dcd6e2b92e703
MD5 hash: 8b5e758cce588804e18d0acba7ad7a45
humanhash: quebec-connecticut-nevada-indigo
File name:COBDEN ORDER.img
Download: download sample
Signature Loki
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-29 11:11:26 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:0RXtpnVH9Az44BnvOCDhzcl0UdKndi2bnXoDza/J/+j6+V:0fd8z4byilBdlGXeFjfV
TLSH C7457D62A2E14833F1672E789C1B5764DB3ABE002E2559453FFC1C4C5F3B6813B662A7
Reporter abuse_ch
Tags:img Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: cobdensupplies.co.uk
Sending IP: 156.96.58.100
From: Pauline <info@cobdensupplies.co.uk>
Reply-To: info@cobdansupplies.co.uk
Subject: ORDER FOR SUPPLY
Attachment: COBDEN ORDER.img (contains "soliyaasx.exe")

Loki C2:
http://doublearowpower.com/vv/hh.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Stealer.19347.10936.15784.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/68f94c06e27dc332ff6b320739b51110481f0795d13807b12ec69d7ef6cf4315/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 11:13:06 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nd4uybxcpxbtf73lgidttnircbeb6b4v2e4apmjoy2ox55wpimkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/68f94c06e27dc332ff6b320739b51110481f0795d13807b12ec69d7ef6cf4315

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

img 68f94c06e27dc332ff6b320739b51110481f0795d13807b12ec69d7ef6cf4315

(this sample)

Loki

Executable exe 9c35e6e5c4ab8e9890319200e4aeb4f38b90f4a7ed39671ee3b3eba28885dd72

  
Dropping
MD5 8cbab837a6d72cb9803a9e85f06c63e6
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9c35e6e5c4ab8e9890319200e4aeb4f38b90f4a7ed39671ee3b3eba28885dd72

Comments