MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73185bd5d0efc6e3cb86c48f2572f055a98c60b6f93d8a2c2f94330b304bdc52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 73185bd5d0efc6e3cb86c48f2572f055a98c60b6f93d8a2c2f94330b304bdc52
SHA3-384 hash: 8ac007c999702521bab1b8b266015fe260e3b3e784f1e2104002370b9822260b5936040f2658fdc49a49d878bdf78522
SHA1 hash: d593d961af8c2629ed8d206e859fc616261a6e87
MD5 hash: 68375782e2cf8f3a5659cb2f4da41f65
humanhash: zulu-white-monkey-lamp
File name:FORM.gz
Download: download sample
Signature Loki
Create hunting rule
File size:657'802 bytes
First seen:2020-10-12 05:56:20 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:HyYiRjoNcKh9D0skNtybLHuHf8x41Npmla5tdWjokwxBMp27vUhjdWB:HyLQDO6LHwq4735z7NBd7vUBI
TLSH B1E4237BCCDD0982F2D9421DE2384EE70A79E7E6D53C640DAD94C83931878CD6AF4968
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: shanghaimetals.pw
Sending IP: 104.168.190.9
From: hr@shanghaimetals.pw
Subject: ATTENTION !!! ATTENTION !!!
Attachment: FORM.gz (contains "FORM.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/73185bd5d0efc6e3cb86c48f2572f055a98c60b6f93d8a2c2f94330b304bdc52/
Threat name:
ByteCode-MSIL.Spyware.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 01:24:38 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ommfxvoq57dohs4gyshsk4xqkwuyyyfw7e6yulbpsqzqwmcl3rja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/73185bd5d0efc6e3cb86c48f2572f055a98c60b6f93d8a2c2f94330b304bdc52

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 73185bd5d0efc6e3cb86c48f2572f055a98c60b6f93d8a2c2f94330b304bdc52

(this sample)

Loki

Executable exe f4b7759a1a42ebd89a61ed697ca26661dff56719bbf254b7b1f400f3cf4487d1

  
Dropping
MD5 17af5b1788202cd07cf1caf71db505e1
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f4b7759a1a42ebd89a61ed697ca26661dff56719bbf254b7b1f400f3cf4487d1

Comments