MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6f8cddcf40a1a04c981396a64b31afc2657c7f96f17933c5e5db59ea55dcb63. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b6f8cddcf40a1a04c981396a64b31afc2657c7f96f17933c5e5db59ea55dcb63
SHA3-384 hash: 9d79aee02cc2e0384c6ba28c77b10c1857812d4f574d166c562e61d23165b553db8c5f21c9f518caa09949590ae3af63
SHA1 hash: 716ac0118d5daf23e88432a1a287a90985b97c72
MD5 hash: e11cc8265bd837dc294c7a9c46f85fbc
humanhash: salami-colorado-neptune-leopard
File name:Augustin Order List.rar
Download: download sample
Signature Loki
Create hunting rule
File size:251'200 bytes
First seen:2020-08-14 14:52:36 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:qmcaxCAoF48ltihCfuArmhdzlXupuzzIB4RTUnpKOB+MLEgCIlK:TKm8ltih4p2zvUnpKOYML+IQ
TLSH 2C34231C9713E4219A68EF2C1772B868FAAF58DDB8F6273337B99981C0C019FB55E410
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mana.com
Sending IP: 45.127.62.179
From: Eziquiel Augustin<cletus@ojeda.ga>
Reply-To: riswanabdeen.gstic@gmail.com
Subject: FW:Augustin Order
Attachment: Augustin Order List.rar (contains "Augustin Order List.exe")

Loki C2:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Troj.Bredo-AIC.19751.18180.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b6f8cddcf40a1a04c981396a64b31afc2657c7f96f17933c5e5db59ea55dcb63/
Threat name:
ByteCode-MSIL.Trojan.LokiSteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 14:54:09 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w34m3xhubinajsmbhfvgjmy27qtfpr7zn4lzgpc6lw2z5jk5znrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b6f8cddcf40a1a04c981396a64b31afc2657c7f96f17933c5e5db59ea55dcb63

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar b6f8cddcf40a1a04c981396a64b31afc2657c7f96f17933c5e5db59ea55dcb63

(this sample)

Loki

Executable exe 724f5d4672837cfb5fda58bf5ec117b177c17486ed9c4bf2fd8325dc836bb0da

  
Dropping
MD5 a9432cff64dbdee66da37dfdbe50a95e
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 724f5d4672837cfb5fda58bf5ec117b177c17486ed9c4bf2fd8325dc836bb0da

Comments