MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b638db58651145a36e19bc7fcc56e0c3c0ad9cb1f88db617141d1f3b81912ca1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b638db58651145a36e19bc7fcc56e0c3c0ad9cb1f88db617141d1f3b81912ca1
SHA3-384 hash: dd6be55fca32bc8003c0519e421aa9b8a0883fb4ebb8a051416fa38d5cac5c8c03491c60430e098f48a0b8df570004d0
SHA1 hash: 312e3ef492fd70d5349162314c69b146cc183789
MD5 hash: 0e56cd30b31a6688dfe208b2730d4597
humanhash: november-august-mountain-pizza
File name:Quotation 2651077.gz
Download: download sample
Signature Loki
Create hunting rule
File size:964'717 bytes
First seen:2021-01-18 18:17:48 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 24576:KdHjC/JFDXpdSDYda4DNqpoVchN+qvw/ELY/qhfemJ36:KdWJtpda4DNqmViDLYiB6
TLSH A7253356370BE1AD64807C1E91E1CFA4079EDCEFDD72823BE290BA763625C12F51E225
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: hj0.309.zrami.ml
Sending IP: 206.189.64.41
From: thomas <david@309.zrami.ml>
Subject: PO 542000348-3&6
Attachment: Quotation 2651077.gz (contains "Quotation 2651077.exe")

Loki C2:
http://51.195.53.221/p.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
140
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis66F1CF3848C3.10666.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b638db58651145a36e19bc7fcc56e0c3c0ad9cb1f88db617141d1f3b81912ca1/
Threat name:
Win32.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2021-01-18 18:18:09 UTC
AV detection:
8 of 46 (17.39%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wy4nwwdfcfc2g3qzxr74yvxaypak3hfr7cg3mfyuduptxamrfsqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.89
Link:
https://yomi.yoroi.company/submissions/b638db58651145a36e19bc7fcc56e0c3c0ad9cb1f88db617141d1f3b81912ca1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz b638db58651145a36e19bc7fcc56e0c3c0ad9cb1f88db617141d1f3b81912ca1

(this sample)

Loki

Executable exe 897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38

  
Dropping
MD5 66f1cf3848c36e8111dc5f5a5784c2ad
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38

Comments