MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92d8fa5bb0c9fc2ead21f095f1593bc84d12e20566fba748ced19388ba5f7290. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92d8fa5bb0c9fc2ead21f095f1593bc84d12e20566fba748ced19388ba5f7290
SHA3-384 hash: 167ed8e795537efb462b41b528f3c1709d21c6a1eca98151c3e18adf0dc24d3a8e260868420558793b074cafb96c6ec3
SHA1 hash: e41be60cdbb19c1c4469b7ca6a2b6e0e8c64d82e
MD5 hash: c05820a711c4e6be4917f605540cf226
humanhash: equal-potato-skylark-alaska
File name:Cleveland Alliances Ltd Quote 63672742.gz
Download: download sample
Signature Loki
Create hunting rule
File size:301'383 bytes
First seen:2020-10-28 08:47:10 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:bTJTwJljbJynRC3jpG+enr5m+60Rr6vHOn9T9S:btTARyReU+er5m+jRrPS
TLSH 125423BC65B8B586F63196BEA525134C1E3465CB0BD2D2F32C423CB8673A93608D3677
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: samidanitrans.com
Sending IP: 5.154.179.251
From: Tony Lugget ~ Cleveland Alliances Ltd <parts@clevelandalliances.com>
Subject: Cleveland Alliances Ltd Quote 63672742
Attachment: Cleveland Alliances Ltd Quote 63672742.gz (contains "Cleveland Alliances Ltd Quote 63672742.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/92d8fa5bb0c9fc2ead21f095f1593bc84d12e20566fba748ced19388ba5f7290/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-10-28 07:23:02 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=slmpuw5qzh6c5ljb6ck7cwj3zbgrfyqfm352osgo2gjyros7okia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 92d8fa5bb0c9fc2ead21f095f1593bc84d12e20566fba748ced19388ba5f7290

(this sample)

Loki

Executable exe 051310f88c9f89055ef4bc239657d27c944f95d881280cbe9f58e03160e7ca2c

  
Dropping
MD5 bd9da7c6df596e275fc86619aa5c7c95
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 051310f88c9f89055ef4bc239657d27c944f95d881280cbe9f58e03160e7ca2c

Comments