MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a7a7a960000dab01d9e0d823a6c81c49eee10bc25af346350fb34327e6bd8ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a7a7a960000dab01d9e0d823a6c81c49eee10bc25af346350fb34327e6bd8ce
SHA3-384 hash: 87f398dca47729e8bbf9505b707ee5183aad32add0891113056650a142e4995295cbce12e151f2949780c395f01c650f
SHA1 hash: 6bdfdd9cb159542b9ef00c7772eab244b0325c20
MD5 hash: fc8d51b8ddf1d40d7604d69a03c188f6
humanhash: massachusetts-carbon-alabama-pennsylvania
File name:Original Invoice PLBL Draft.gz
Download: download sample
Signature Loki
Create hunting rule
File size:223'857 bytes
First seen:2021-01-19 07:30:34 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:N0dNUGE0Mm1ml514jYDO0YXLIe6mb5IOp+:NyGsk5145ZUGb5j+
TLSH 4A24237EF0E226D69881D1AB69EC172D57B3C153F8B5AB311745F68002A4FE1CADCE60
Reporter abuse_ch
Tags:DHL gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: ycg0.217.bnjo.ml
Sending IP: 167.172.103.40
From: DHL Express <support@dhl.com>
Subject: Consignment Notification: Your Shipment Has Arrived
Attachment: Original Invoice PLBL Draft.gz (contains "Original Invoice PL&BL Draft.exe")

Loki C2:
http://51.195.53.221/p.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
161
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn25.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Bang5mai-6804572-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7a7a7a960000dab01d9e0d823a6c81c49eee10bc25af346350fb34327e6bd8ce/
Threat name:
Win32.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 07:31:15 UTC
AV detection:
15 of 46 (32.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pj5hvfqaadnlahm6bwbdu3ebyspo4ef4ewxtiy2q7m2de7tl3dha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7a7a7a960000dab01d9e0d823a6c81c49eee10bc25af346350fb34327e6bd8ce

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 7a7a7a960000dab01d9e0d823a6c81c49eee10bc25af346350fb34327e6bd8ce

(this sample)

Loki

Executable exe 43e7e33417e21b41c839b367474714e1b889eeb68f13838a7d2ddbdaa8ddf6b6

  
Dropping
MD5 f0503b1899bd51b123d100d1802695eb
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 43e7e33417e21b41c839b367474714e1b889eeb68f13838a7d2ddbdaa8ddf6b6

Comments