MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e4e25d12079b026042cb3e2ee103b31528c51684569066cde61b06962b1f0d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7e4e25d12079b026042cb3e2ee103b31528c51684569066cde61b06962b1f0d3
SHA3-384 hash: 3fd0e1fb07c5a5bf6b4b926aea73a032c83c05bbe0ac3854fa1af4378c1d494007f559df03b2a3dfc0e2edb05eff9330
SHA1 hash: 9c017a93b42b5d733d8d61a361216f08c323f632
MD5 hash: cd56ff32d5a289cc7da87a74ea726404
humanhash: asparagus-mississippi-october-music
File name:DOCUMENTATION.pdf.rar
Download: download sample
Signature Loki
Create hunting rule
File size:440'758 bytes
First seen:2020-10-27 12:50:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:wSl7ro1ZJ3G8MECeAeNPKK5OoPFmTI4yLLv1DgGTleisofDCMcUApvGKDTGO3oVI:EJpzKKfMu+alYofDCxpFXbisoSAXSt9
TLSH 7094235D437F7EC9C5AB43F1C91A8EB3C0DD829823A96387327E2CC87D2565F552092A
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server.filmworld.tv
Sending IP: 70.32.31.17
From: lfsfrn.operations@liftfreight.com
Reply-To: pkd.lycheu@gmail.com, pkd.lycheu@gmail.com
Subject: NEED NEW TAX INVOICE PO#140798
Attachment: DOCUMENTATION.pdf.rar (contains "rdJtuCxsBo2hKRp.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.8709.9416.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7e4e25d12079b026042cb3e2ee103b31528c51684569066cde61b06962b1f0d3/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 09:46:33 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pzhclujapgycmbbmwpro4eb3gfjiyuliivuqm3g6mgygsyvr6djq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7e4e25d12079b026042cb3e2ee103b31528c51684569066cde61b06962b1f0d3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 7e4e25d12079b026042cb3e2ee103b31528c51684569066cde61b06962b1f0d3

(this sample)

Loki

Executable exe 722acf13b4974e81aaaf9211873a8cd3b80c1bfec41dcfa2e83e77a3e3339549

  
Dropping
MD5 c4e02954ec853f79b84b369f12b689e1
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 722acf13b4974e81aaaf9211873a8cd3b80c1bfec41dcfa2e83e77a3e3339549

Comments