MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a120cafd058562b6439074eeb82983613c1d4a337edac1be3685f815f8ddc2e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a120cafd058562b6439074eeb82983613c1d4a337edac1be3685f815f8ddc2e3
SHA3-384 hash: 80c0af98ceac9d4df10224ba6b575d0f7d634c61dea31e3c327f01d6a0ac61012c4c071f2fc33d0dd178f6f069c571f5
SHA1 hash: 5116093002c73e04b00c37027d3039092c3b3fcd
MD5 hash: 5d83e21c0ba8cb44b597f8155346ab1b
humanhash: twelve-edward-march-harry
File name:DHL.r00
Download: download sample
Signature Loki
Create hunting rule
File size:875'853 bytes
First seen:2020-08-18 11:00:20 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 24576:iC17ccxeSF4ktaD83XM9Nwf4sN2Z9yh0kD0BkQLU6CIxZSl34:iC1YS2maQM9efKLeRI3XR
TLSH 431533874E029D704ADD878475BF7DC25C423DC62AEA10A54E4E637AFCB147AC7708BA
Reporter abuse_ch
Tags:DHL Loki r00


Avatar
abuse_ch
Malspam distributing Loki:

HELO: swn0.721.zazomika.ml
Sending IP: 178.62.210.203
From: DHL Express<NoReply.ODD@dhl.com>
Subject: YOUR DELIVERY IS TODAY
Attachment: DHL.r00 (contains "DHL.exe")

Loki C2:
http://193.142.59.18/mc1/3/pin.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
50
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a120cafd058562b6439074eeb82983613c1d4a337edac1be3685f815f8ddc2e3/
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 11:02:06 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ueqmv7ifqvrlmq4qotxlqkmdme6b2srtp3nmdprwqx4bl6g5ylrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a120cafd058562b6439074eeb82983613c1d4a337edac1be3685f815f8ddc2e3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

r00 a120cafd058562b6439074eeb82983613c1d4a337edac1be3685f815f8ddc2e3

(this sample)

Loki

Executable exe 7fce676b063449eecd1236727598513639a7fd166d6e2f86dce138b97636d572

  
Dropping
MD5 2593808318d4f797e305492da210762f
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7fce676b063449eecd1236727598513639a7fd166d6e2f86dce138b97636d572

Comments