MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97ba366b31c871610913008bebb5bc3ac2c5988291aca6502f9507f35a79d9f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 97ba366b31c871610913008bebb5bc3ac2c5988291aca6502f9507f35a79d9f9
SHA3-384 hash: eed3fe1f9c10415cdb75a74edfe861c356230ee92f2928685782f718d5106c731a44c27adc74e6520c216aef968ffeec
SHA1 hash: 8ba64673c6d32bc700d7dd6f6eefb042cb141cbb
MD5 hash: 67eebada97aab02a6a28519f2446c8c0
humanhash: network-floor-summer-fourteen
File name:WA-IMG10090 Bank Order SN0097453 SHEET.rar
Download: download sample
Signature Loki
Create hunting rule
File size:625'996 bytes
First seen:2020-05-26 06:59:33 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:9Qy9Wcrb82kp/yPzShz4Ug5/Af+V/4wxOPoTw3u7YqB0cxf0Rq9W+j:KaFrbNkpAd4gJP4umAs4N
TLSH AED423BB0BA14863A744B5052F9449567F1831261DEDA3B70E37A5AE2F9B0E3300D6F9
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: ns1.dbschenkey.pw
Sending IP: 173.82.130.84
From: Maria, Accounts <accounts@avant.con>
Subject: PRE:RE:ayment (24-05-2020)
Attachment: WA-IMG10090 Bank Order SN0097453 SHEET.rar (contains "WA-IMG10090 Bank Order SN0097453 SHEET.exe")

Loki C2:
http://mecharnise.ir/da9/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 07:36:25 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 97ba366b31c871610913008bebb5bc3ac2c5988291aca6502f9507f35a79d9f9

(this sample)

Loki

Executable exe 859f31fec3c2996d51e3ce2e6671485f8779027bbd7f954e346cde76742c3fc2

  
Dropping
MD5 e8eace694ce478eda6df578dc2b8e610
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 859f31fec3c2996d51e3ce2e6671485f8779027bbd7f954e346cde76742c3fc2

Comments