MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fcb438180d303b4912f233fa101d8cd42ce3dcd0817495a576671051999db89. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7fcb438180d303b4912f233fa101d8cd42ce3dcd0817495a576671051999db89
SHA3-384 hash: 628a4100e5a7ddb2bf74684c2da6cb65176285460a6f6da72e3375e5ce24c10b192194b5a12f47855408310c10643e65
SHA1 hash: 0269f78855829c2c6c4a8fccf810d180992849c3
MD5 hash: 5374e6c663e8e524da12af3406df5a47
humanhash: montana-blossom-kentucky-nebraska
File name:Scan01_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:366'831 bytes
First seen:2020-05-04 21:03:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:ckmEEnLzmg11M5IEz8ZhHJqooLpmIxYgm3WKHWMTVIsq0i21KpJvtwkxbUDHboQ:3mr/RwPzaLrEVjm3WXMTVIsvKlwklKH3
TLSH 1074237B619916B57F1FC3168C6DA266197CC8FD877B8C8B4F0601C93F466118B866C8
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: upg.adnslhosting.com
Sending IP: 198.15.82.214
From: Yamauchi Hong Kong Ltd <eva@yamauchi.com.hk>
Subject: Shipment advice 653421.9867540
Attachment: Scan01_pdf.gz (contains "Scan01_pdf.exe")

Loki C2:
http://rnarport.com/divide/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.24839.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Lokibot
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 20:21:00 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p7fuhama2mb3jejpem72caoyzvbm4ponbaluswsxmzyqkgmz3oeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 7fcb438180d303b4912f233fa101d8cd42ce3dcd0817495a576671051999db89

(this sample)

Loki

Executable exe 0335ac823df0b17f54d4c84ad8a2976d1d79423545d356cd1433205af7c99706

  
Dropping
MD5 9e49e3b444811720eb79013019b28611
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0335ac823df0b17f54d4c84ad8a2976d1d79423545d356cd1433205af7c99706

Comments