MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b9392f516429a1a2f3d8aad31a153e42b404a3984a78de9d740e0f24dca44b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b9392f516429a1a2f3d8aad31a153e42b404a3984a78de9d740e0f24dca44b9
SHA3-384 hash: 0728f51591155c2a4bce55cdc0a56c05c4a08bf57eb8f9b0d67628910394fada4fbd214a5ceb113bbffc6a4501dc7baa
SHA1 hash: e59052a8f53b17a3ec40d483c4cab0e07ab6bf1e
MD5 hash: 2a26233ad54ce10098df1aa18565b186
humanhash: papa-batman-hotel-zulu
File name:PO copy.pdf.z
Download: download sample
Signature Loki
Create hunting rule
File size:311'887 bytes
First seen:2020-06-18 05:25:55 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:4FaQ1FgNZVvilv8woDzH+gUZb8oU5l3PuKnJcoWPbOXxl5Avk1KYwCo3pec:a+ZV6lvngUZb8T5l3PJMP6z+t39
TLSH E46423793158EBBDE1B6EF3BF2D08FE0D3A30454E2558ECA0DCBAE1561290439B35592
Reporter abuse_ch
Tags:Loki z


Avatar
abuse_ch
Malspam distributing Loki:

HELO: yandex.ru
Sending IP: 95.211.208.58
From: Export Department <ac.general@yandex.ru>
Subject: 答复:Urgent Request for Invoice
Attachment: PO copy.pdf.z (contains "PO copy.pdf.exe")

Loki C2:
http://reiangkor.com/uploads/images/Gallery/Panel/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 05:27:05 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rojzf5iwiknbulz5rkwtdikt4qvuasrzqsty32oxidqpetokis4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z 8b9392f516429a1a2f3d8aad31a153e42b404a3984a78de9d740e0f24dca44b9

(this sample)

Loki

Executable exe d1ce05f5836d693a291249dd4a0e40bedb77d43f2eb701ef38f762c85d1e44f6

  
Dropping
MD5 8dc0a8a56106d9845e8ae9c021f02cec
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d1ce05f5836d693a291249dd4a0e40bedb77d43f2eb701ef38f762c85d1e44f6

Comments