MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81a0bf20177ac2ef6c2bbd6034b0e3540e8e9f08f81abb555f93d3a7c4fc01b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81a0bf20177ac2ef6c2bbd6034b0e3540e8e9f08f81abb555f93d3a7c4fc01b0
SHA3-384 hash: 224afa528bd6d9c7648f22b0be7d06fdee2bd935cb89cd7343f06e34d21bc600571eedf0eabcf61fc891c904aa5e9eb8
SHA1 hash: 6ffe58060cd82d4bfe8f3959e6f0a16fe6bc081d
MD5 hash: 468241502fb51cb5f99711faa4503117
humanhash: zebra-oven-bulldog-delaware
File name:Fedex85520.zip
Download: download sample
Signature Loki
Create hunting rule
File size:882'332 bytes
First seen:2020-06-15 13:37:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:fmWWuTOOtEW0XVYz9SiSXfSVJAV3vpM81L7Jwhb:fmi12XV0SJCeXM8L7c
TLSH 2B1523E7086E2882C40846157054E9D291E7BFD496EF046F8FC664CDB2A7364E4CEF9E
Reporter abuse_ch
Tags:FedEx Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.bgesoaeg.ml
Sending IP: 64.52.172.177
From: Fedex Express Ltd. <tonking@bgesoaeg.ml>
Subject: Parcel Arrived.
Attachment: Fedex85520.zip (contains "Fedex85520.exe")

Loki C2:
http://goggl.ml/chammy/global/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Casdet
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 13:39:06 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qgql6iaxplbo63blxvqdjmhdkqhi5hyi7anlwvk7spj2prh4agya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 81a0bf20177ac2ef6c2bbd6034b0e3540e8e9f08f81abb555f93d3a7c4fc01b0

(this sample)

Loki

Executable exe a7b2c2dfcb01c3c3b3dc945f3b8d1c907a4de8aba291241466a9da4c69492a29

  
Dropping
MD5 e18a27c28946a96a8503049ea1cb36c4
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a7b2c2dfcb01c3c3b3dc945f3b8d1c907a4de8aba291241466a9da4c69492a29

Comments