MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84f790d3001a31818512aa7f5343bb0a1c3b529408b5668831f788a4801b10df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 84f790d3001a31818512aa7f5343bb0a1c3b529408b5668831f788a4801b10df
SHA3-384 hash: 41c00964bff63eae0a43b7568261fbb6aff603300211e67561fccaaec23b28b451ba880b26124ff58aebbaf2711b141d
SHA1 hash: be31330272c9b831a46185348f6f2027cef23a47
MD5 hash: 9d1b0d8c538574ced9d2450304bdd3e1
humanhash: nevada-twenty-potato-sad
File name:Salary_slip.rar
Download: download sample
Signature Loki
Create hunting rule
File size:301'793 bytes
First seen:2020-05-11 13:07:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:EkU+CcMkZGJjz4bF7iskyvcBhgxZmGmk8tNm9oPzH73yrTAZ0yD:EkYk2EFRFvcLhTg6zH7irTAnD
TLSH 41542298C98C630835BB9F5CEF05E6526E2120CA75C34624AB3F4F4FB6757E1E2C6249
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: sadana.dua.rumahweb.com
Sending IP: 103.253.212.215
From: Personalia <recruitment@antam.id>
Subject: PaySlipEmail M1
Attachment: Salary_slip.rar (contains "Salary_slip.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 13:36:17 UTC
File Type:
Binary (Archive)
Extracted files:
396
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qt3zbuyadiyydbisvj7vgq53biodwuuubc2wncbr66ekjaa3cdpq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 84f790d3001a31818512aa7f5343bb0a1c3b529408b5668831f788a4801b10df

(this sample)

Loki

Executable exe 87435dd1a14d8a428088bcca64f19da8c6d7cc9d6a1c0cbc70cee30df36dbd25

  
Dropping
MD5 9b3743512802c59c1481db10ecebf8a9
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 87435dd1a14d8a428088bcca64f19da8c6d7cc9d6a1c0cbc70cee30df36dbd25

Comments