MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b830be1999415537b8fd405406ae38ae50372e19b676608879edc68aba790da0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b830be1999415537b8fd405406ae38ae50372e19b676608879edc68aba790da0
SHA3-384 hash: c167aae1ba69f3d9f07984f393db6ab493d16448236e910f483eca959b986dcb89167756fdeaf8564478b31b510ab1c2
SHA1 hash: 7867694d26e4b4917d8aa3b650d57bcc5282f5ce
MD5 hash: d2e6be26a0f1677fa83a68628153b87b
humanhash: muppet-kansas-leopard-queen
File name:BUSINESS NOTIFICATION ON COVID-19 CORONAVIRUS DOCUMET_pdf.arj
Download: download sample
Signature Loki
Create hunting rule
File size:1'010'860 bytes
First seen:2020-05-06 17:59:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:2NTnoe3o8C0/908LqtIXmGwMGMSanIkleReoVtzbU0ha+lyv/3ld3:2NLoeYV0/9uy2GI3AIkleReoVxbaqs/b
TLSH 5E253315A11508DBE285C33F877E503F884EC392819E1DB90E5712530EFEF26DBE8AA5
Reporter abuse_ch
Tags:arj COVID-19 Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: s1.smallhost.in
Sending IP: 103.46.239.70
From: CENTER FOR DISEASE CONTROL & MANAGEMENT <HeungJung@cahayapack.com.my>
Subject: COVID-19 UPDATE // BUSINESS CONTINUITY PLAN ANNOUNCEMENT STARTING MAY\x0a 2020.
Attachment: BUSINESS NOTIFICATION ON COVID-19 CORONAVIRUS DOCUMET_pdf.arj (contains "BUSINESS NOTIFICATION ON COVID-19 CORONAVIRUS DOCUMET_pdf.exe")

Loki C2:
http://attlogistics-vn.com/first/chief2/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 10:50:03 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xayl4gmzifktpoh5ibkanlryvzidolqzwz3gbcdz5xdivotzbwqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip b830be1999415537b8fd405406ae38ae50372e19b676608879edc68aba790da0

(this sample)

Loki

Executable exe 9e26d68332abb02fb2e80a924f83eb8614afe4e8b841f51c9f82fd0c986d4571

  
Dropping
MD5 f0934645e28ba2ad506552a7deb3cdee
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9e26d68332abb02fb2e80a924f83eb8614afe4e8b841f51c9f82fd0c986d4571

Comments