MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b1a0d00960755cc9e1b01b26253bc6c1d39732d861b79cd983bab321210b073. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b1a0d00960755cc9e1b01b26253bc6c1d39732d861b79cd983bab321210b073
SHA3-384 hash: 588e3c8994d11e4d8e9c1688b44c2029350ea0d12a49a00c86b2d96ba50ab4cbc6752d118b4c1d2cf0cfa4ba11d5fc9b
SHA1 hash: 51b2020598ea79f4e40d63b706515fea233bb18d
MD5 hash: 991cba15088f2e52b5310145d2d39bcf
humanhash: lactose-sweet-georgia-xray
File name:PO No. 104393019_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:380'807 bytes
First seen:2020-08-17 13:51:46 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:hlJAsxbb98T1Ph1sfaoGpUfqpIzGqHtf7pSthK/M3nWXYpslvvNgPWhRCem:hBxbO1sS9eSpEhs/Kk3nWIOv1xCn
TLSH 2C8423CAA90297C2E2A24E50776CECC317FBD9DF18F189413CB0A378D21EA716DC1955
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: m-pmark-cp01.hosting.zen.co.uk
Sending IP: 51.148.48.51
From: Bahr Muhammad <info@albahralarabi.com>
Subject: URGENT PURCHASE ORDER No. 959309292
Attachment: PO No. 104393019_pdf.gz (contains "PO No. 104393019_pdf.exe")

Loki C2:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6b1a0d00960755cc9e1b01b26253bc6c1d39732d861b79cd983bab321210b073/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 13:53:05 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nmna2aewa5k4zhq3agzgeu54nqots4znqynxttmyhovteeqqwbzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6b1a0d00960755cc9e1b01b26253bc6c1d39732d861b79cd983bab321210b073

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 6b1a0d00960755cc9e1b01b26253bc6c1d39732d861b79cd983bab321210b073

(this sample)

Loki

Executable exe a4273258f20011ca2466a27ca652b8cb2febf6ef5cfea22c608cd17be702834e

  
Dropping
MD5 55426dbbf79308e847a8a8fffc2583cd
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a4273258f20011ca2466a27ca652b8cb2febf6ef5cfea22c608cd17be702834e

Comments