MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e28633cb7404eba40524a07cde4149b6c215954093bc6c8945382fc9a95feef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e28633cb7404eba40524a07cde4149b6c215954093bc6c8945382fc9a95feef
SHA3-384 hash: 9b6831a414eb0503f69d16d8ccf011b199d87912beddd9a0d5765d2e776466cdcde00c8633bce659b67e0e2433a67788
SHA1 hash: 424a49054973500159990a5c3782ce6ecf33feae
MD5 hash: 49e7d6a46abea193317571bb184b04b1
humanhash: bravo-wolfram-london-oregon
File name:Oznmenie o platbe - Euro Bank.gz
Download: download sample
Signature Loki
Create hunting rule
File size:494'794 bytes
First seen:2021-01-19 12:59:47 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:EP+WWEmxERGnlx7D6wXBCQpyMQwyhnTdWeHgRh16i:EPLGnlhDtBCQpxuTdARh1n
TLSH 32B433CE29C98F75ACF9676325D94F5F709F51AC62683D4A04C74D223CD0B9C0AC26AC
Reporter abuse_ch
Tags:geo gz Loki SVK


Avatar
abuse_ch
Malspam distributing Loki:

HELO: zephir.ph
Sending IP: 45.137.22.41
From: ÚČTY / ANCHELÉN <info@zephir.ph>
Subject: Oznámenie o platbe - Euro Bank EFG
Attachment: Oznmenie o platbe - Euro Bank.gz (contains "Oznámenie o platbe - Euro Bank.exe")

Loki C2:
http://becharnise.ir/fa2/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e28633cb7404eba40524a07cde4149b6c215954093bc6c8945382fc9a95feef/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 13:00:14 UTC
AV detection:
4 of 46 (8.70%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nyuggpfxibhluqcsjid43zautnwccwkube54nseukobpzguv73xq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6e28633cb7404eba40524a07cde4149b6c215954093bc6c8945382fc9a95feef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 6e28633cb7404eba40524a07cde4149b6c215954093bc6c8945382fc9a95feef

(this sample)

Loki

Executable exe 61cf371d87b081dbca8f7dacc088c35238295b5c71c79a8f06ab209dcbc7ff48

  
Dropping
MD5 6db32b93132d79c5876dc469120f1fc3
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 61cf371d87b081dbca8f7dacc088c35238295b5c71c79a8f06ab209dcbc7ff48

Comments