MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba167984676eeac1307b81f5410739ec309aad4ec2988d9e4266d1c6a449de9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba167984676eeac1307b81f5410739ec309aad4ec2988d9e4266d1c6a449de9e
SHA3-384 hash: b1b9262f5aa4e6f2a33a5b76ebd32b2a1f4d6b1c9560f256f6849b3b5e454202d57cafbcd8412bb1abbf8e80580aa705
SHA1 hash: d0f2c64e01ea3a1aaf395ac5866a953ec11aed1b
MD5 hash: d67f3775f1d531b12ed148311eef6e26
humanhash: kitten-paris-ack-north
File name:CHECKERS RFQ 0019901828289.PDF.gz
Download: download sample
Signature Loki
Create hunting rule
File size:148'185 bytes
First seen:2020-07-16 08:20:39 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 3072:qmpQo0zSEKx8jpXAW5ogFDFjiueq/fe36y7pVKyzI/iPlSdXS++:qAQ6x8tXZnrWueAe3g/4x
TLSH 63E32201F88A10879DEF97AE67D93421B590F4B59D17CE758E43CBD2C2A4B40AF38396
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: slot0.griferaisnova.com
Sending IP: 107.174.244.100
From: order@checkers.co.za
Subject: RFQ 0019901828289
Attachment: CHECKERS RFQ 0019901828289.PDF.gz (contains "CHECKERS RFQ 0019901828289.PDF.exe")

Loki C2:
http://winqits.com/~zadmin/lk/me/gate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba167984676eeac1307b81f5410739ec309aad4ec2988d9e4266d1c6a449de9e/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 08:22:07 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xilhtbdhn3vmcmd3qh2ucbzz5qyjvlkoykmi3hscm3i4njcj32pa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz ba167984676eeac1307b81f5410739ec309aad4ec2988d9e4266d1c6a449de9e

(this sample)

Loki

Executable exe 85261f175271fe271ff3010d3eb2ec251f1d14aae84a25cddcd189b81b32b415

  
Dropping
MD5 286293e2ce99fd16fc88c38e2fc74538
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 85261f175271fe271ff3010d3eb2ec251f1d14aae84a25cddcd189b81b32b415

Comments