MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b42ba3f62be963fe0ed14b61e5623f241fc67d47a4c553f64b6ef4ab566ebdad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b42ba3f62be963fe0ed14b61e5623f241fc67d47a4c553f64b6ef4ab566ebdad
SHA3-384 hash: a089e71942f110c79618b8bbb6bada9f16a5c43186ba09da7cca9574cf800e8299c1ce109e61c7093053d6669ad38fef
SHA1 hash: 957cd89b073cb3ab534e3e85256b0048f596b83e
MD5 hash: 219cb185d79b91b1852853d85f6dfc61
humanhash: muppet-jersey-coffee-gee
File name:Bukti - PEMBAYARAN JULI 2020.CVS.zip
Download: download sample
Signature Loki
Create hunting rule
File size:242'320 bytes
First seen:2020-07-22 07:10:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:UQRK8QASBu02xjZuquP9e/uKMjaDz3SA7ZdVZ:fK8KAZuj9e/B4aDOA7Zp
TLSH 663423E5D96FDCBA111D3FF6CA82C80896B9DF652E0C09943B720582A47B5DB17006FE
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: bre.r1host.com
Sending IP: 136.243.102.137
From: PT. COSCO SHIPPING LINES INDONESIA <b.sakhipour@bre-line.com>
Subject: RE: REQ DRAFT INVOICE = BL : COAU7224806530
Attachment: Bukti - PEMBAYARAN JULI 2020.CVS.zip (contains "Bukti - PEMBAYARAN JULI 2020.CVS..exe")

Loki C2:
http://modevin.ga/~zadmin/lmark/frega2/mode.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

PUA.Win.Adware.Browserio-6725861-0
Create hunting rule

SecuriteInfo.com.Artemis162931E90DCF.4593.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b42ba3f62be963fe0ed14b61e5623f241fc67d47a4c553f64b6ef4ab566ebdad/
Threat name:
Win32.Trojan.Nemesis
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 07:12:07 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wqv2h5rl5fr74dwrjnq6kyr7eqp4m7khutcvh5sln32kwvtoxwwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b42ba3f62be963fe0ed14b61e5623f241fc67d47a4c553f64b6ef4ab566ebdad

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip b42ba3f62be963fe0ed14b61e5623f241fc67d47a4c553f64b6ef4ab566ebdad

(this sample)

Loki

Executable exe c97c066f1bbcb89f4c1caa11d490c179a62a872ab8884437b99407ecd1dc44f8

  
Dropping
MD5 76c5b1c746ecfb2aadbf7738b80bc393
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c97c066f1bbcb89f4c1caa11d490c179a62a872ab8884437b99407ecd1dc44f8

Comments