MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b18f0b55c10dfc8cadc269b507d9f7acfe39cee5acfc24b3f4458d5e463f2abc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b18f0b55c10dfc8cadc269b507d9f7acfe39cee5acfc24b3f4458d5e463f2abc
SHA3-384 hash: 98941ccca7646956267a7037b22298383c77a2d3210a8f2a44fba818e7bc7e1705f821d8e0b978b468057464fc171914
SHA1 hash: c8a34a1ba59615f31f591caf8f03f346466a453b
MD5 hash: df60abf511c9edab6ba5518f281dc0ba
humanhash: tennis-early-comet-mississippi
File name:Bank Details_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:357'781 bytes
First seen:2020-05-28 06:40:33 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:90mSRm4kc24QfD+PmqH4fopIEo0skIDs3+0YOlsRwuq0ek2LZhNKttyZioX1nRC:d3/4QJqWoWpkIl5Xr/G43yZh1U
TLSH A47423DED2A0BE82305BE947C75A25726EE158DDC50A00D4A8320DDCE0F4F1BB7C262D
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: staging.maykenbel.com
Sending IP: 195.12.49.182
From: Rafał Gąsior <rafal.gasior@astoria.pl>
Reply-To: Rafał Gąsior <rafal.gasior@astoria-pl.com>
Subject: RE: URGENT-Confirm Account Details/SOA Feb-May
Attachment: Bank Details_pdf.gz (contains "Bank Details_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Artemis3956A314271F.14689.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 07:44:23 UTC
File Type:
Binary (Archive)
Extracted files:
296
AV detection:
15 of 48 (31.25%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz b18f0b55c10dfc8cadc269b507d9f7acfe39cee5acfc24b3f4458d5e463f2abc

(this sample)

Loki

Executable exe 5050aa15ae2665809374245eea91ebb52f03a2639941bcf044d8f6cb6602f589

  
Dropping
MD5 728df5ae51b171d8b9805bc0e79cb8f3
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5050aa15ae2665809374245eea91ebb52f03a2639941bcf044d8f6cb6602f589

Comments