MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77c3d86ba2c1e5b62e13bd8e019226267ad9879d7df93a9263a0c34a53118f92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 77c3d86ba2c1e5b62e13bd8e019226267ad9879d7df93a9263a0c34a53118f92
SHA3-384 hash: df7e8ae3da84a3740822ca4c0ab7c81966827d0a3bc9a0fc552b2c9122abbb680fa4f16a015beddd07f1a1a41ba82894
SHA1 hash: e1d7df1f332e546066fa21718940dc0193971157
MD5 hash: 1761537256e5cbc9b6c33e35a785b0d6
humanhash: earth-nitrogen-muppet-beryllium
File name:RFQ-06-01-21.json.zip
Download: download sample
Signature Loki
Create hunting rule
File size:823'175 bytes
First seen:2021-01-06 07:42:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:cRI0Ft3wsFBj8Oz8TkIYUtbapPWzL6yUY1avbdNyPlheHUkhbTaIA96Z:cR+szuz2yUoubqhwUmaIA96Z
TLSH F105336ED294BF8020494F9E713A16DD1271FF0159565B8F20180F81BFB6D3A9E2BE93
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: jktd3khmail02v.cloudkilat.me
Sending IP: 103.43.47.239
From: Madiha Rasheed <buroil@cyber.net.pk>
Reply-To: Madiha Rasheed <buroil@cyber.net.pk>
Subject: Request for quotation.
Attachment: RFQ-06-01-21.json.zip (contains "RFQ-06-01-21.json.exe")

Loki C2:
http://tuandat-vn.com/llz/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
203
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/77c3d86ba2c1e5b62e13bd8e019226267ad9879d7df93a9263a0c34a53118f92/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o7b5q25cyhs3mlqtxwhadergez5ntb45px4tvetdudbuuuyrr6ja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/77c3d86ba2c1e5b62e13bd8e019226267ad9879d7df93a9263a0c34a53118f92

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 77c3d86ba2c1e5b62e13bd8e019226267ad9879d7df93a9263a0c34a53118f92

(this sample)

Loki

Executable exe 94fad6ab9bc344630eed1bfe1c545394a4a66a2281334a2fe9f16b2b9206707f

  
Dropping
MD5 ac47a9a7c574c17ac64228ae8e6d6796
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 94fad6ab9bc344630eed1bfe1c545394a4a66a2281334a2fe9f16b2b9206707f

Comments