MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93c588b84d11093aed19a0861514bd31c64a741158b010340e000d49f301c896. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93c588b84d11093aed19a0861514bd31c64a741158b010340e000d49f301c896
SHA3-384 hash: 733550fd87e3a97ce6c2815256b869b69b4e471524325a9f712e3112c1efce9a1c7e5c4923c266a23fbd7447e73d4422
SHA1 hash: c4d292a3306022e67697b98602a3ac3b8bd109cb
MD5 hash: 151702d2b77fb269ead343f7a73a13d1
humanhash: arkansas-hotel-charlie-undress
File name:E-Statement.gz
Download: download sample
Signature Loki
Create hunting rule
File size:331'077 bytes
First seen:2021-01-18 08:26:07 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:FGV3sy9IWk45ZsIngf5U+2De3888rd7B51T2+06n7Vp869dgI/d3g7:KsyqWbVQf2De3888rd7/p2+3n7V2irVg
TLSH 0F642311A2D35837D8C73184A9F2401BE382F7B7F90A519338B5C66ACB5E7D146A36EC
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: hrl.comsats.net.pk
Sending IP: 203.124.39.163
From: DIBPL E Banking <atiqa@rdlpk.com>
Reply-To: estatement@dibpak.com
Subject: E-Statement of your Bank Account
Attachment: E-Statement.gz (contains "E-Statement.exe")

Loki C2:
http://impulsetechnosoft.com/home/cc/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Firseria-6804617-0
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/93c588b84d11093aed19a0861514bd31c64a741158b010340e000d49f301c896/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2021-01-18 08:16:05 UTC
AV detection:
14 of 46 (30.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=spcyrocnceetv3izucdbkff5ghdeu5arlcybanaoaagut4ybzcla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/93c588b84d11093aed19a0861514bd31c64a741158b010340e000d49f301c896

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 93c588b84d11093aed19a0861514bd31c64a741158b010340e000d49f301c896

(this sample)

Loki

Executable exe faca80f4cbe69a258c8075a6e5b83d0dd01c9bfcc67060240321e973f12a8ea5

  
Dropping
MD5 947982ab39d010f2f98af775e397d872
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 faca80f4cbe69a258c8075a6e5b83d0dd01c9bfcc67060240321e973f12a8ea5

Comments