MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f1278ddad96d321be1e941d0e3bc7c96519965043dfa7b2f19573b35af3804f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f1278ddad96d321be1e941d0e3bc7c96519965043dfa7b2f19573b35af3804f
SHA3-384 hash: 5e43df8d348de39620f4869d63240b584e356159f69cb7cbdb5698a8ee6639a8739df1dbae3e53de9b8e27d19c299c3e
SHA1 hash: 10787754540c773b3907ec7017a83714de546f68
MD5 hash: 952bc53ecc2d03d2f77124d0b64b1bc6
humanhash: bakerloo-batman-diet-seven
File name:REQUEST FOR QUOTATION RFQ No. SC-ACW-39941.pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:139'714 bytes
First seen:2020-06-10 09:54:39 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 3072:fprZ3vuvgd+U3dnrkS7Z2Rd5J77lNeMM16zpxE:hrZ3Q8+WZ/idP7RvM1CpO
TLSH 04D323455BBD934FDF2ABC34B662DAF1873D308CAE1CA2C481D46D1AB8718328B55C5D
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: host.sasavomarketing.com
Sending IP: 199.217.117.135
From: info@southeycontracting.com
Subject: REQUEST FOR QUOTATION [RFQ] No. SC-ACW-39941
Attachment: REQUEST FOR QUOTATION RFQ No. SC-ACW-39941.pdf.gz (contains "REQUEST FOR QUOTATION RFQ No. SC-ACW-39941.pdf.exe")

Loki C2:
http://auongo.com/~zadmin/lk/dn/gate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 09:56:05 UTC
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n4jhrxnns3jsdpq6sqoq4o6hzfsrtfsqipp2pmxrsvz3gwxtqbhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 6f1278ddad96d321be1e941d0e3bc7c96519965043dfa7b2f19573b35af3804f

(this sample)

Loki

Executable exe 890d50ea38e546ea886c5e1d211327e2d4573f3a55f1afc56eacc36ed2187474

  
Dropping
MD5 cbeabc5f462af901e2ded6eac5d73a65
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 890d50ea38e546ea886c5e1d211327e2d4573f3a55f1afc56eacc36ed2187474

Comments