MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 acdf381e27f93d5b67b01cdb878a2abaa0eafe986d83732ae8ab982a93a751d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: acdf381e27f93d5b67b01cdb878a2abaa0eafe986d83732ae8ab982a93a751d7
SHA3-384 hash: e2dad54404b1d77af871ad000db4f73d69a880419f4ed8fec2f728beb88bba408cfc18bb5112db75a2e49763f1bbf5ad
SHA1 hash: a9ae7834b2cbb0aec4d86065ebc1107b4ac98562
MD5 hash: 5f9581100a1d095a7298e674e353c7ed
humanhash: victor-mississippi-nine-fifteen
File name:invoice.zip
Download: download sample
Signature Loki
Create hunting rule
File size:978'267 bytes
First seen:2020-04-30 06:15:41 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:TGCMrCoYJ7RFVBA2EwGLPG7EW6DnEK8N90tjGS5/jPs6Uk:mrCoYJ7bIe6DEBN90YS+6Uk
TLSH 852533737CF387261EAB8020082EC4AD985D523C195069D2946D937BEBC37B4DA7726F
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: monta.com
Sending IP: 94.177.240.87
From: jeffrey@howtoforge.com
Subject: Re: Arrive Logistics Account Statement
Attachment: invoice.zip (contains "invoice.exe")

Loki C2:
http://mecharnise.ir/da4/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21615.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23810.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 09:28:08 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vtptqhrh7e6vwz5qdtnypcrkxkqov7uynwbxgkxivomcve5hkhlq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip acdf381e27f93d5b67b01cdb878a2abaa0eafe986d83732ae8ab982a93a751d7

(this sample)

Loki

Executable exe 67917e8a295ace02f84c39d08c1691c651fc143901c4525f3178af87a837e1a6

  
Dropping
MD5 f4698084afaa7d49184ceaa45bf1043d
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 67917e8a295ace02f84c39d08c1691c651fc143901c4525f3178af87a837e1a6

Comments