MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b006323cbfd9a5d88a0c95d2b61bf7420c737ea879ae98b8c6def756f280cf01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b006323cbfd9a5d88a0c95d2b61bf7420c737ea879ae98b8c6def756f280cf01
SHA3-384 hash: b4173730db4fd87e8b20134488b2fcc4364a8fc83fd433829b45e8eaad41a9b301de0fe945dec823990c90d20e2f76f8
SHA1 hash: 99ec0fe4d1c6ca6b5c6fba1ee03837f34dec95d1
MD5 hash: 2bfda78d77449540a7cfd3360e2026db
humanhash: oklahoma-tango-hot-angel
File name:20S0207DS.gz
Download: download sample
Signature Loki
Create hunting rule
File size:386'498 bytes
First seen:2020-05-18 08:24:20 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:+WClwUsJaINdgL4b01L70ZTNXk8uRyap4a1MoTnBUMJS9KM+yCOT0cEU:+W0mH501iZXkr5M8nBUMJ++yCnU
TLSH 0B84233421C93748AD3B7BC5A99D80307B076E5D0B2FA74E8A963ED5809D4FF0626D1B
Reporter abuse_ch
Tags:gz Loki SCB


Avatar
abuse_ch
Malspam distributing Loki:

HELO: vps.honeywell-egypt.com
Sending IP: 204.93.168.246
From: Standard Chartered Bank <AdviceID@sc.com>
Subject: RE: SCB - Advice of Refusal
Attachment: 20S0207DS.gz (contains "20S0207DS.exe")

Loki C2:
lmpulsefashion.net/three/gates2/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.CookieTools.13993.13725.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 04:05:22 UTC
File Type:
Binary (Archive)
Extracted files:
296
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=waddepf73gs5rcqmsxjlmg7xiighg7vipgxjrogg333vn4uaz4aq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip b006323cbfd9a5d88a0c95d2b61bf7420c737ea879ae98b8c6def756f280cf01

(this sample)

Loki

Executable exe 7e6aa0355230689f19f9c49fc2357413fa3af7c6ee0571836175190de84e810d

  
Dropping
MD5 1fe197a6a7c06d1c9b77acf31c25e4a2
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7e6aa0355230689f19f9c49fc2357413fa3af7c6ee0571836175190de84e810d

Comments