MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a390ac3c1dcb493a6712832959d66de6b622c345623c43de74edb275f43cda56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a390ac3c1dcb493a6712832959d66de6b622c345623c43de74edb275f43cda56
SHA3-384 hash: 3ebebf2d30ebd6ed0ac329bc9b4f63f4db3034c5c6539598766921523efa7d480dd63b34a80e1beaaca1b3b38103eaf4
SHA1 hash: 2f3f5cd1129327767a46aaf162efd86c51c060a4
MD5 hash: 556bd49b197782af5006664ec9061f53
humanhash: apart-tennessee-speaker-bravo
File name:Arrival Details_DOC_MEDUI1938022...._PDF.gz
Download: download sample
Signature Loki
Create hunting rule
File size:595'793 bytes
First seen:2020-10-13 05:54:48 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:R0A2/e1x5A4/2GM0YmBkeqt6i0Tx3XiLshxUvWeayyf4FPu4/h4WMb:RpWe1x5A4uVt+/qQi0t3yGUz5ywFPYX
TLSH C0C423C742B4AFFBC45DC63B86EF29124999051E7F0990D656423B9705C03B77EA33A2
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server.devbox12.com
Sending IP: 162.249.2.44
From: Warren Smith <warren@airwaveaust.com.au>
Reply-To: Warren Smith <ricknicolas.aol@hotmail.com>
Subject: Arrival Notice of B/L#MEDUI1938022 on MSC VIVIANA/FT038E
Attachment: Arrival Details_DOC_MEDUI1938022...._PDF.gz (contains "Arrival Details_DOC_MEDUI1938022...._PDF.exe")

Loki C2:
http://milonga-a-promotora.pt/wp778/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.44055512.23145.22366.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a390ac3c1dcb493a6712832959d66de6b622c345623c43de74edb275f43cda56/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 21:33:26 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uoikypa5znetuzysqmuvtvtn423cfq2fmi6ehxtu5wzhl5b43jla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/a390ac3c1dcb493a6712832959d66de6b622c345623c43de74edb275f43cda56

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz a390ac3c1dcb493a6712832959d66de6b622c345623c43de74edb275f43cda56

(this sample)

Loki

Executable exe 4ad80d29a42caae7aea0c2f789f6f1b7f104f98de269777be04b8cbde41e2678

  
Dropping
MD5 b3597cea7fa7ed3ab66065ce01968968
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4ad80d29a42caae7aea0c2f789f6f1b7f104f98de269777be04b8cbde41e2678

Comments