MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97d9a5b7cdd71f55383eb577c43895ce5514881b538c6bcc22fa8c78c41d3c22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 97d9a5b7cdd71f55383eb577c43895ce5514881b538c6bcc22fa8c78c41d3c22
SHA3-384 hash: ec4426abd0e71eb02450dbf9774abe623d48eefb39cfa1d5e5ab2beceddef6f82ed0da3b2adf0cdc8d7a78223380c869
SHA1 hash: 5e91f19976fe1329180a7a59f3c9c9de6c280d0d
MD5 hash: 6532bc3d80550d6f3edcca76edf31d2a
humanhash: aspen-india-oxygen-venus
File name:New PO for DJ Engineering PO EA00003333.gz
Download: download sample
Signature Loki
Create hunting rule
File size:336'870 bytes
First seen:2020-05-19 14:28:52 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:kwuaJcNdzcZfQ4MttgiS5n+d6HbJvWsVGobF7tgpC3y5ocjaVWL/SxBHGaM:kljzcpQ4MttJSd+o7JvWsVFVtgpCQVjX
TLSH BF642353EB8A6BE56308112EB808C453F13E6F97C357EE4BB939D00DF882A5C17498D2
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: slot0.hoss-mecyberia.com
Sending IP: 45.95.169.170
From: Dawn Lord <DLord@djgrp.com>
Subject: New PO for DJ Engineering PO# EA00003333
Attachment: New PO for DJ Engineering PO EA00003333.gz (contains "gunzipped")

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 14:37:11 UTC
File Type:
Binary (Archive)
Extracted files:
266
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s7m2ln6n24pvkob6wv34ioevzzkrjca3koggxtbc7kghrra5hqra._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 97d9a5b7cdd71f55383eb577c43895ce5514881b538c6bcc22fa8c78c41d3c22

(this sample)

Loki

Executable exe 4224ad915442d3db1c1c6e77ae9c689fcf2db123aa1f9c1582472888acff9682

  
Dropping
MD5 a8a2388939260601edf4a1174425932b
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4224ad915442d3db1c1c6e77ae9c689fcf2db123aa1f9c1582472888acff9682

Comments