MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1bb899ffdddeab935fc10abf0805d8e1935c590a4af93c0767f7986b78bc944. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1bb899ffdddeab935fc10abf0805d8e1935c590a4af93c0767f7986b78bc944
SHA3-384 hash: 5b127d126aa7a5cdacf92eaeb67926da82a6bf51bb4df9db8fb2cb9b1b8eb8b7bddc5a80fdeea44309ad9db70c6f1261
SHA1 hash: 1503a44aca7e4e23128eb7552b9e83ceea90417c
MD5 hash: aa9f90361a359be532d1df69cd42ffff
humanhash: kansas-speaker-carolina-five
File name:Quotation Complete Overhaul of Main Engine Niigata.zip
Download: download sample
Signature Loki
Create hunting rule
File size:569'387 bytes
First seen:2020-10-09 06:13:03 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:uVF155acjNlQhCzdB7PHwlYR6utdgdUW7DWt44ljLhX5bhlq1:KF15oglQ4D7PHw+R6utdgdl4hffW
TLSH FBC4231374A75A5BD6FDAB8E4B4E746132FC55D2A7E2C84003C4E8C858E93C7939DE28
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: holy.herosite.pro
Sending IP: 159.65.99.182
From: BIOMED DEVICES CO LTD (KSA) <mukalla@mukraycem.com>
Subject: purchase Order
Attachment: Quotation Complete Overhaul of Main Engine Niigata.zip (contains "Quotation Complete Overhaul of Main Engine Niigata.exe")

Loki C2:
http://piavee.com/class/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b1bb899ffdddeab935fc10abf0805d8e1935c590a4af93c0767f7986b78bc944/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 21:58:10 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wg5yth753xvlsnp4ccv7bac5rymtlrmqusxzhqdwp54ynn4lzfca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/b1bb899ffdddeab935fc10abf0805d8e1935c590a4af93c0767f7986b78bc944

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip b1bb899ffdddeab935fc10abf0805d8e1935c590a4af93c0767f7986b78bc944

(this sample)

Loki

Executable exe 6610e0fcc8cd3c9692cb6ed661b188ac68a02f0d2c29151347955ed2cd16ece5

  
Dropping
MD5 41d33f590df894581a26f84e1077649b
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6610e0fcc8cd3c9692cb6ed661b188ac68a02f0d2c29151347955ed2cd16ece5

Comments