MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e3c2eaf567670a0d8121c7f0019f2790a7e1648b5e4d69fb3f882b04ec4a029. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e3c2eaf567670a0d8121c7f0019f2790a7e1648b5e4d69fb3f882b04ec4a029
SHA3-384 hash: 10207c32b25695fc9fba0270b79a6fd04f78e7e794cb92552b579a2d3fe176f0526748351bd289b1118a4957ef9db7bf
SHA1 hash: c7e03db1bc91554d85f77f73aba3e42d30b0a9d2
MD5 hash: 36e0a49db451027bf1f5198a3c5072e3
humanhash: stairway-eight-delta-lion
File name:Plan primene preventivnih mera - Covid·docx.zip
Download: download sample
Signature Loki
Create hunting rule
File size:376'976 bytes
First seen:2020-08-13 12:41:08 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:8yLfVFnuJp7fDpyAlisCPTo5AlX8F8fBDwbwYPAkdC4XDsc2jS:8yLVhuLrFqjWF8ROjPAqXx
TLSH 8C842332D5758A74B63D6A26CF0B9985CCBA58F5E6E07D4DDCB224C33FF89A44201E09
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.proing.si
Sending IP: 37.61.201.120
From: Ministarstvo zdravlja Srbije <Katarina.Vojvodic@batut.org.rs>
Reply-To: katarina.Vojvodic@batut.org.rs
Subject: Plan primene preventivnih mera (Ministarstvo zdravlja Srbije)
Attachment: Plan primene preventivnih mera - Covid·docx.zip (contains "Plan primene preventivnih mera - Covid·docx.exe")

Loki C2:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Variant.Zusy.311248.5720.6726.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9e3c2eaf567670a0d8121c7f0019f2790a7e1648b5e4d69fb3f882b04ec4a029/
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 12:43:05 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ty6c5l2wozykbwasdr7qagpspefh4fsiwxsnnh5t7cblatweuauq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9e3c2eaf567670a0d8121c7f0019f2790a7e1648b5e4d69fb3f882b04ec4a029

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 9e3c2eaf567670a0d8121c7f0019f2790a7e1648b5e4d69fb3f882b04ec4a029

(this sample)

Loki

Executable exe c4b617def78629851cc46040994b385c369ec849a28d791605f39a0eb294ac6e

  
Dropping
MD5 6c2c4af6acb98f7409e7524e3d468c7a
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c4b617def78629851cc46040994b385c369ec849a28d791605f39a0eb294ac6e

Comments