MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d2d0878a06a4b1d440b0113732f71a7d0c0c8e718f01e2110e74a7d6b404c52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7d2d0878a06a4b1d440b0113732f71a7d0c0c8e718f01e2110e74a7d6b404c52
SHA3-384 hash: 5f124e275607b5b268a43f502346ddd6501882f4fe679f39d2352785d920a4f3c3b956369d2efa46ee0b5ff5cc6ac808
SHA1 hash: 5cac3a784af2c997a124433b22d3c995814953b0
MD5 hash: 08373a344ccbf8af277ef3c2a9eaf940
humanhash: romeo-sweet-uranus-william
File name:Nuevo orden.img
Download: download sample
Signature Loki
Create hunting rule
File size:1'507'328 bytes
First seen:2021-01-14 06:57:01 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:2+uvkUs5DoDu1DfDIIh/POJ5jL8nKIGzM+OvyKPmT5aETAp7AFss:2kUQoVXXym6vV+Gp7X
TLSH A2656D09ABD5A700F3FD6ABE5464003066FAE955B6B8D22DDC81707B9F719AC00FD782
Reporter abuse_ch
Tags:img Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: smarthost1.gohsphere.com
Sending IP: 173.0.129.225
From: alejandro alvarez <alejandro.alvarez@triboilgas.com>
Subject: RE: Nueva consulta / orden de cotización...
Attachment: Nuevo orden.img (contains "Nuevo orden.PDF.bat")

Loki C2:
http://51.195.53.221/p.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
150
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Bulz.305305.26413.15388.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7d2d0878a06a4b1d440b0113732f71a7d0c0c8e718f01e2110e74a7d6b404c52/
Threat name:
Win32.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-01-14 06:57:09 UTC
AV detection:
14 of 44 (31.82%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=puwqq6fanjfr2ralaejxgl3ru7imbshhddyb4iiq45fh222ajrja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7d2d0878a06a4b1d440b0113732f71a7d0c0c8e718f01e2110e74a7d6b404c52

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

img 7d2d0878a06a4b1d440b0113732f71a7d0c0c8e718f01e2110e74a7d6b404c52

(this sample)

Loki

Executable exe 644fe9320e421d92bf74b5ab972f3fcef4e07fc0ff9cc21cdc3d569b49201ad5

  
Dropping
MD5 abb865db5097adc68c8c9915c39e6534
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 644fe9320e421d92bf74b5ab972f3fcef4e07fc0ff9cc21cdc3d569b49201ad5

Comments