MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 859bd2ddd7b1627333fc4ffbb9233130977ba1c4b6e7907a47f66bf99eb8ea24. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 859bd2ddd7b1627333fc4ffbb9233130977ba1c4b6e7907a47f66bf99eb8ea24
SHA3-384 hash: 68c0947928eaa7d2b7bfffe754f3540ea83ccd55af762a6a4d8166b44ea3be335bb5988f1b972ac525ecfae715ebfa5b
SHA1 hash: b468f19721e6e72f06c67ac27a920a54ac277265
MD5 hash: 0e30335a61c7d4dcbf74b5a8ff384e95
humanhash: iowa-timing-delta-snake
File name:20201020153903.arj
Download: download sample
Signature Loki
Create hunting rule
File size:318'734 bytes
First seen:2020-10-21 07:02:42 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:895aE0o/q2/RHgeCiq+UiZ8jma51ze3D4+izgS+x9Cn4EmrI0JR+TbjFO:bE0L2pEifULK3DFizgS+PU4EmMzTc
TLSH 50642399CAE50C5E72B25CCAE434837D42CC7CD62D8ADBDE8461761E2C64946EEE03DC
Reporter abuse_ch
Tags:arj Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: dbd0.307.mevvia.ml
Sending IP: 157.230.187.88
From: Divyashree V <251@307.mevvia.ml>
Subject: RE: New Order
Attachment: 20201020153903.arj (contains "20201020153903.exe")

Loki C2:
http://mecharnise.ir/eb2/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/859bd2ddd7b1627333fc4ffbb9233130977ba1c4b6e7907a47f66bf99eb8ea24/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 13:37:45 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qwn5fxoxwfrhgm74j753sizrgclxxioew3tza6sh6zv7thvy5isa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

arj 859bd2ddd7b1627333fc4ffbb9233130977ba1c4b6e7907a47f66bf99eb8ea24

(this sample)

Loki

Executable exe 8f4ef7a003086d6927f303ae1a1be81f71ed764204d4d2be97150890c37b559e

  
Dropping
MD5 e3da3126acbaed0ea03a5b56a5aeefc8
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8f4ef7a003086d6927f303ae1a1be81f71ed764204d4d2be97150890c37b559e

Comments