MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7cb7199723fa2b77fa2d7204dc05ed10587395ade2f28c450e542445b05e44a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b7cb7199723fa2b77fa2d7204dc05ed10587395ade2f28c450e542445b05e44a
SHA3-384 hash: 7b0dcddad74c60f9d52c5d36f0beb09027ea8a4cc0c03bfd28ea3083835526f6b1bfbd041b4787e27e37237242f7bbe3
SHA1 hash: f4c5953dee2e59491e818a515f905a037f58240b
MD5 hash: 255e16a71c2fd0e2bb77a2c8e51b89b4
humanhash: social-cola-yankee-fifteen
File name:IM_Doc_0003520270.PDF.gz
Download: download sample
Signature Loki
Create hunting rule
File size:394'862 bytes
First seen:2020-11-19 06:51:26 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:gmhWz4QORmY3TWit0k90vyKHrJW+J23m0tp/J:gmhWzfLYVmvDrJGZ3
TLSH 02842308F4CEF7A75DE0BC73C88E887E11A2BF070A176678861AC52A817C3D1D64917E
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail-gate2.qwords.net
Sending IP: 103.195.91.242
From: Bank Danamon Indonesia, TBK <andriyana@smpl.co.id>
Subject: RE: Import and Loan (Interest and Principal) Maturity Report
Attachment: IM_Doc_0003520270.PDF.gz (contains "IM_Doc_0003520270.PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b7cb7199723fa2b77fa2d7204dc05ed10587395ade2f28c450e542445b05e44a/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-19 06:52:09 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w7fxdglsh6rlo75c24qe3qc62ecyook23yxsrrcq4vbeiwyf4rfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz b7cb7199723fa2b77fa2d7204dc05ed10587395ade2f28c450e542445b05e44a

(this sample)

Loki

Executable exe cf6dbf95f4ca71e2c1feb180fa97d44107dc7f1222acdcaed8519c77e67c4a89

  
Dropping
MD5 8cef2f0310a5c39d7ec9ac1f7ff0eaaa
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cf6dbf95f4ca71e2c1feb180fa97d44107dc7f1222acdcaed8519c77e67c4a89

Comments