MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 781d994c6bf0d2c2434337b85f879c38c633375c49423c207bca6c7d1e023a6d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 781d994c6bf0d2c2434337b85f879c38c633375c49423c207bca6c7d1e023a6d
SHA3-384 hash: f13c40f5819ef44b2579c80c49c9fb45165430e5940de3e92c2c40b91e39a2b761b7dd1b6620e457b02c32418f441078
SHA1 hash: 9f2fe486552cc9c76fba00f4514cecb630440f51
MD5 hash: e2f4c70cbb6bd21ec0f6dc4e07d6e5fc
humanhash: eight-whiskey-michigan-venus
File name:RFQ6H7594-H.PDF.z
Download: download sample
Signature Loki
Create hunting rule
File size:214'132 bytes
First seen:2020-06-12 06:40:37 UTC
Last seen:2020-06-12 10:18:11 UTC
File type: z
MIME type:application/x-rar
ssdeep 3072:bjJz+iYWodXGQuiLA+n6p03v6+SvkRdSIRsefbHzGiEdNEJhsVJpDtHzJ8+xPw:bjJfHodSinf6URdhRTjEfEjsTzJ8+xo
TLSH B324220E150E8120702D7F75E04947BCF4645667219819AFAB6ECC431FB47BACBA387E
Reporter abuse_ch
Tags:Loki z


Avatar
abuse_ch
Malspam distributing Loki:

HELO: telkomsa.net
Sending IP: 156.96.47.116
From: Goran skimic<bmpe@telkomsa.net>
Reply-To: Goran skimic<brnpe@telkomsa.net>
Subject: revised product enquiry june rfq3076h
Attachment: RFQ6H7594-H.PDF.z (contains "RFQ6H7594-H.PDF.exe")

Loki C2:
http://irangoodshop.com/nop/fre.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 06:42:08 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=paozstdl6djmeq2dg64f7b44hdddgn24jfbdyid3zjwh2hqchjwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z 781d994c6bf0d2c2434337b85f879c38c633375c49423c207bca6c7d1e023a6d

(this sample)

Loki

Executable exe 7c20a515d31bae8b3a15773630ec4bd95c5dbceb78797a91ec258ea4bd2210a2

  
Dropping
MD5 675411d2b71ef47a2f1263e1e053ea9a
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7c20a515d31bae8b3a15773630ec4bd95c5dbceb78797a91ec258ea4bd2210a2

Comments