MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f1dc411f6d78d59b693d0ef3a0f92854ecfb09a583a0ae691f3e7dba13b4f86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f1dc411f6d78d59b693d0ef3a0f92854ecfb09a583a0ae691f3e7dba13b4f86
SHA3-384 hash: 8a6fff0fd5f76a5c143fcd02252e2fd57436b618898051e4724730c639873ad5f68e5092683994612a5e01c72ac2efa8
SHA1 hash: eb470223539e66bade39c8d6382314695ab287d7
MD5 hash: 48ff30e53872fc9c7ad18389cd16028c
humanhash: fanta-east-charlie-august
File name:MT103_PDF.arj
Download: download sample
Signature Loki
Create hunting rule
File size:794'212 bytes
First seen:2020-05-12 09:21:52 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:uSSgg5BZf1k20SIXm4bPZkB1eBH6eVmnPMo:uTPfBo2aZ1jmPMo
TLSH 52F423877CEDEC6F10990B51DBB85008BD3F6FE728426D47B6383A4A6079D8A478D076
Reporter abuse_ch
Tags:arj Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: pkz48-3-spamexpert2.hoster.kz
Sending IP: 185.113.132.44
From: accsupport <sco_transaero@ttk.kz>
Subject: Payment Advice - Advice Ref:[G61184613334] / Priority payment
Attachment: MT103_PDF.arj (contains "MT103_PDF.exe")

Loki C2:
http://oneflextiank.com/cream/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 02:13:28 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p4o4iepw26gvtnut2dxtud4sqvhm7me2la5avzur6pt5xij3j6da._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 7f1dc411f6d78d59b693d0ef3a0f92854ecfb09a583a0ae691f3e7dba13b4f86

(this sample)

Loki

Executable exe 466bcd346f7746f757c815e968cb0872849770b923669392ff8219f235c95fb8

  
Dropping
MD5 8e18a302f123824ae9a7a0967d3d21fd
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 466bcd346f7746f757c815e968cb0872849770b923669392ff8219f235c95fb8

Comments