MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aff4f8d512bae119f21f3f97f0eb12f609b1e0323bacbdcd17bcbd2e28480753. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aff4f8d512bae119f21f3f97f0eb12f609b1e0323bacbdcd17bcbd2e28480753
SHA3-384 hash: 759fc640841608873aeb4cb0e8bfd9f197a1fe1389cb39f6b9d27fe7e1e5cbe683fe2644a17bf1230eb4f2e6eb1b8c52
SHA1 hash: c8d92afcbbfd82c1a5d0c73695c89a6382e9df0e
MD5 hash: f10c946c314c01c4d1e9c8505507386a
humanhash: chicken-robert-mississippi-aspen
File name:Purchase Order.gz
Download: download sample
Signature Loki
Create hunting rule
File size:402'976 bytes
First seen:2020-11-19 06:36:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:wYmd4TS4/LChEEE86nWvMapLLXKiEda812Qsge3l4Lh37zhP5RoMuSmCyfgY28UJ:SaFEsn8Eda8vngl4J9PjJuEyuCg
TLSH CA84233A8E7925909B5147D3186F2F17D489B3802CA58AD81FEC7F5E3CF7029B899489
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: remium3.guzelhosting.com
Sending IP: 176.53.65.131
From: M Krishna Kumar <krishna@binsanadholding.com>
Subject: New Project RFQ Rotating Pumps Purchasing
Attachment: Purchase Order.gz (contains "TQ-03865.exe")

Loki C2:
http://paciflxinc.com/bryt/bryt5/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aff4f8d512bae119f21f3f97f0eb12f609b1e0323bacbdcd17bcbd2e28480753/
Threat name:
Win32.Ransomware.Cryptor
Create hunting rule
Status:
Malicious
First seen:
2020-11-19 06:37:06 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v72prvisxlqrt4q7h6l7b2ys6ye3dybshowl3tixxs6s4kcia5jq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip aff4f8d512bae119f21f3f97f0eb12f609b1e0323bacbdcd17bcbd2e28480753

(this sample)

Loki

Executable exe 64a2d15c015c4df70467f9eb1b6d8979f0d634369f07b2aa8171ff7647bb7bb2

  
Dropping
MD5 fba4608d6c9fd8d45701f6630491e081
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 64a2d15c015c4df70467f9eb1b6d8979f0d634369f07b2aa8171ff7647bb7bb2

Comments