MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f9d7ea5435c73f2078d7d66a234af1ab9ad3dcae03c50640039a3e46dab18f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f9d7ea5435c73f2078d7d66a234af1ab9ad3dcae03c50640039a3e46dab18f6
SHA3-384 hash: 63abf22ed76e556e74ddc4f776f75529718c90eb28827685c288ee7652e5ed2f15dc279e75b33a6c19a758c37596681a
SHA1 hash: c76f5162b673b84b3ef464af9755bfbcca593edc
MD5 hash: 0af308a4092f75ae85516a16e4fbdb4d
humanhash: five-potato-asparagus-green
File name:Scan_Document_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:418'372 bytes
First seen:2020-10-09 15:44:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:PL7NKKXMdm6TpIkCSQOxY0TDtfVDj2jTsnmIsgV+7wvbiPMKUzx7NkpFtNa:PL7NWhGyT3VD+TG8w+09SpnU
TLSH E19423AE0007301EEC23E5E862EFAC0604241EF5963BD556DC7298AF3F5EDCDA4591AD
Reporter abuse_ch
Tags:gz Loki TNT


Avatar
abuse_ch
Malspam distributing Loki:

HELO: kyuf0.612.omre.ml
Sending IP: 165.227.143.144
From: TNT EXPRESS <Airene.Jovellanos@tnt.com>
Subject: Consignment Notification: WB-260820200131222
Attachment: Scan_Document_pdf.gz (contains "Scan_Document_pdf.exe")

Loki C2:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f9d7ea5435c73f2078d7d66a234af1ab9ad3dcae03c50640039a3e46dab18f6/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 13:49:51 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t6ox5jkdlrz7eb4npvtkenfpdk422pok4a6fazaahgr6i3nldd3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9f9d7ea5435c73f2078d7d66a234af1ab9ad3dcae03c50640039a3e46dab18f6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 9f9d7ea5435c73f2078d7d66a234af1ab9ad3dcae03c50640039a3e46dab18f6

(this sample)

Loki

Executable exe b252ee4bb76b6f31587ea0820ee4c3989f39e7f4c921397ecd79f1718c854cbe

  
Dropping
MD5 c5c966a35ab41b3de5bc5a085f4f1eed
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b252ee4bb76b6f31587ea0820ee4c3989f39e7f4c921397ecd79f1718c854cbe

Comments