MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8095b1b8d484b5f00fc27d718efedeb1752197bbe9e12bfdfdb26095242b23dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8095b1b8d484b5f00fc27d718efedeb1752197bbe9e12bfdfdb26095242b23dd
SHA3-384 hash: 9a5d1c6c59d2e8c3b636fe833f56d1d4d136e8fd67c9537bf153991a847b414442c1d869d44098674595e880e548cfac
SHA1 hash: d070e816bebc4e5b76aa8dc247199f7dd0d535b8
MD5 hash: 7249c3d0451849fc2aeeb08e37b4c2de
humanhash: arkansas-thirteen-oranges-football
File name:2004270BCVXO_PDF.gz
Download: download sample
Signature Loki
Create hunting rule
File size:420'589 bytes
First seen:2020-04-30 06:29:45 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:tRHzZpAZLj5ek5LHmhnwIF1+jWOYxbJ89865UuCa24QYdHWUPL6+:fiN5LPeYjYbJ89865Uq27mL6+
TLSH BA94234320DE87D963832250C5D1BB26CD4B66EC7FBB21012A67871A3A35D385963FBD
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: cross.net.id
Sending IP: 137.59.13.130
From: K-eDocument <risal@mks.cross.net.id>
Reply-To: K-eDocument <ricknicolas.aol@hotmail.com>
Subject: Credit Advice (Inward Remittance)
Attachment: 2004270BCVXO_PDF.gz (contains "2004270BCVXO_PDF.exe")

Loki C2:
http://missingandfound.com.my/pull/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 06:35:39 UTC
File Type:
Binary (Archive)
Extracted files:
40
AV detection:
32 of 48 (66.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qck3doguqs27ad6cpvyy57w6wf2sdf535hqsx7p5wjqjkjblepoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 8095b1b8d484b5f00fc27d718efedeb1752197bbe9e12bfdfdb26095242b23dd

(this sample)

Loki

Executable exe 012c98fa766957b510c96eafcf27545deef616fe356a066c172c2426d373dbec

  
Dropping
MD5 2a512dc9338886f8860bdb28a77b2e20
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 012c98fa766957b510c96eafcf27545deef616fe356a066c172c2426d373dbec

Comments