MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 978fb60348a3c68aa7c7e7f31f53dceb7ca1bb56909877acb50d6e02ff8d0e5f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 978fb60348a3c68aa7c7e7f31f53dceb7ca1bb56909877acb50d6e02ff8d0e5f
SHA3-384 hash: b91a65c436da0fda9b62b923f32a53a85c1398c5ac4eebf6ba07c1ca009ab725f8ccbeaf92d43f3943f72e8ca6e78c23
SHA1 hash: 2bf15dbb65a5cbe2d0cd60acadc91f32c5a87c96
MD5 hash: 57bc02abf45ceccff2f8847dbb81843a
humanhash: artist-avocado-twenty-winter
File name:Debit note May-20_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:370'758 bytes
First seen:2020-06-02 05:57:08 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:KoxgUQZow00QXixK/aFJ1+lnXptUNf5eneAuCOBN4svICO3sC3jWGzmbL4pYPxig:xPQiw5QXiTbAXpSAeAuLvpvICMjWGkxV
TLSH 047423D41DA61F3C62E73767D562E2931EF3A3890B057E66050E0F5C4361ACBB5AA30D
Reporter jarumlus
Tags:Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 00:48:58 UTC
File Type:
Binary (Archive)
Extracted files:
286
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s6h3ma2iupdivj6h47zr6u645n6kdo2wscmhplfvbvxaf74nbzpq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 978fb60348a3c68aa7c7e7f31f53dceb7ca1bb56909877acb50d6e02ff8d0e5f

(this sample)

Loki

Executable exe f02f1aa81359a40dc5654db55fe211c8dff8c88a790d10089fcbca1840a84c3a

  
Dropped by
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f02f1aa81359a40dc5654db55fe211c8dff8c88a790d10089fcbca1840a84c3a
  
Dropping
MD5 c0a2d0e5fbc2c4cca88b1e22f1b91539

Comments