MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7729a029e5f6305bbd81083a626fc8a50140b5bf230ffdce6b788bfd5453f36b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7729a029e5f6305bbd81083a626fc8a50140b5bf230ffdce6b788bfd5453f36b
SHA3-384 hash: 61a1f9bdb50ab36bab449890f0a44c044aa0b70bec28a877bb7f424186e06bac9589a14f49a1051cd2c62870bce2f462
SHA1 hash: d1efcbc4e096aedb9fbcb61b437fa2c8588dcc96
MD5 hash: 8ae91b4c7c83324658d86d0fa4ae9d3c
humanhash: pip-jupiter-glucose-wyoming
File name:copy scan-101121_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:433'235 bytes
First seen:2020-10-22 07:42:51 UTC
Last seen:2020-10-23 09:25:41 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:p0DZXEiUUZhEgzDzL0fDRIpx/0YLo1MX74fSaB49nWqQbBzTKiKu139jNvjN7LTY:CDUUbbDzVoqrcSa3tb5xdbT5q
TLSH 9F94235066E9F0875F011FF0932162A5D2411AA6BCCCA07859B2DB6C3D3DF9C9D87C5B
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: hosted-by.rootlayer.net
Sending IP: 185.222.57.164
From: BSMC Best Sport Material China <petermzj@vip.163.com>
Subject: Fwd: Re : scan B/L.. URGENT ATTENTION NEEDED..
Attachment: copy scan-101121_pdf.gz (contains "copy scan-101121_pdf.exe")

Intelligence

File Origin
# of uploads :
9
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7729a029e5f6305bbd81083a626fc8a50140b5bf230ffdce6b788bfd5453f36b/
Threat name:
Win32.Trojan.LokibotCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 03:22:03 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o4u2akpf6yyfxpmbba5ge36iuuaubnn7emh73ttlpcf72vct6nvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 7729a029e5f6305bbd81083a626fc8a50140b5bf230ffdce6b788bfd5453f36b

(this sample)

Loki

Executable exe ed76de60fc812d7a8361a6b476f960ed8d3c07a6e1425d6c02c5d63e449cb0b3

  
Dropping
MD5 836e5b8fad52c3ca4d9cf374793e3a24
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ed76de60fc812d7a8361a6b476f960ed8d3c07a6e1425d6c02c5d63e449cb0b3

Comments