MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85fc06181ceb5feed69f8d502be451ed8758b0548d49c08a94f74adfeb51b2b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85fc06181ceb5feed69f8d502be451ed8758b0548d49c08a94f74adfeb51b2b7
SHA3-384 hash: 2ba8fc7d78e43334efee9fb7c98a5b8e2d62d6f86309bdc1bf10e4058d4cf7214033284fcea56b168ca539419d968d65
SHA1 hash: cbf417bdeb3dc2d2d11037785fe2b82dda46ec88
MD5 hash: 11d4e919279cda8b2f6dda8e5feb6a80
humanhash: carolina-uniform-quebec-floor
File name:Doc8290-2872992_file Tiki_doc.gz
Download: download sample
Signature Loki
Create hunting rule
File size:22'888 bytes
First seen:2020-04-29 18:55:05 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 384:a+oXpD+caVsL1yNLMW8ObWPUU9bQtEu3ltFNU4kVCNvhxHUHKpF+cK9a7K:heaVsgNIopU9bQKu37cdV27UHUKKK
TLSH 96A2D00D109F9F6EAF5C221BAB155DC1CC0802B18965B83F791880E73AB599CAD35DB7
Reporter abuse_ch
Tags:geo gz IDN Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: iix81.rumahweb.com
Sending IP: 103.247.9.22
From: TiKi INDONESIA <service@kitacentradana.com>
Subject: TiKi Indonesia PRE Alert for AWB862409W7||Peringatan PRE TiKi Indonesia untuk AWB862409W7//
Attachment: Doc8290-2872992_file Tiki_doc.gz (contains "Doc8290-2872992_file Tiki_doc.exe")

Loki C2:
http://smkamiliapaguyangan.sch.id/amz/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.LokiBot-7726350-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 19:36:01 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qx6amga45np65vu7rvicxzcr5wdvrmcurve4bcuu65fn722rwk3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 85fc06181ceb5feed69f8d502be451ed8758b0548d49c08a94f74adfeb51b2b7

(this sample)

Loki

Executable exe 277ad2e30607538075324d56c194f6256f2a37245f952038d709f237545bf0f1

  
Dropping
MD5 64ba93c4848245fd41e2a6215433b035
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 277ad2e30607538075324d56c194f6256f2a37245f952038d709f237545bf0f1

Comments