MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa00e0d81f6205f668b3f85d25fbeeaecf8d4ec96cdd0924dc4886a1498d5a7d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa00e0d81f6205f668b3f85d25fbeeaecf8d4ec96cdd0924dc4886a1498d5a7d
SHA3-384 hash: 6b6d40442d8eb3223b862fd0421465d123000c6faab21b11418d208ea8b69db69dc8d7b285250df07b6cfd88189fb2be
SHA1 hash: 46b73beb8321beb650af951ad70bb2e6ccbb2c5a
MD5 hash: b341eb151758f953e3f8897321580523
humanhash: burger-timing-happy-friend
File name:scan-iu562987_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:444'948 bytes
First seen:2020-05-13 06:08:45 UTC
Last seen:2020-05-13 08:29:14 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:N3SzDWxcyIl5nEKqEXudtNZlap585mu0ATltRDWHnbzV1WRSmeOzgP2GuwcHLG:N3Sz6xxAnzeDlE58XJtRCnzmeOzgtmrG
TLSH FC9423D8ED951A817B72E68B0D9A8DE7D3317CDE67FE500B71B4223288494ED273092D
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: hyatt.com
Sending IP: 103.99.1.147
From: SHANGHAI WORLD FINANCIAL CENTER<shanghai.park@hyatt.com>
Subject: Customer Settlement account
Attachment: scan-iu562987_pdf.gz (contains "scan-iu562987_pdf.exe")

Loki C2:
http://broken8.cf/LO4/fre.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 03:09:51 UTC
File Type:
Binary (Archive)
Extracted files:
296
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=viaobwa7mic7m2ft7bosl67ov3hy2twjntoqsjg4jcdkcsmnlj6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip aa00e0d81f6205f668b3f85d25fbeeaecf8d4ec96cdd0924dc4886a1498d5a7d

(this sample)

Loki

Executable exe 819a4b9f58a58605f607ca0d655519592155dabadab75419400ec0ca1a1116ee

  
Dropping
MD5 4422ce9d33cc9bc527e9f0be78fd0deb
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 819a4b9f58a58605f607ca0d655519592155dabadab75419400ec0ca1a1116ee

Comments