MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb64ec41dfcfef6520203e2384700c97303c361e12ce9c797658a44b43e2bb89. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb64ec41dfcfef6520203e2384700c97303c361e12ce9c797658a44b43e2bb89
SHA3-384 hash: 11bf3ef761221d3b87cba4dd58573eeeb68f92aeeb372adee594fe5b95bccc6fa4439fd287a48134d03322facf339fa3
SHA1 hash: 5a7d61f195354bfff39f9c605e6d621ce654b35f
MD5 hash: cb1259b2791a78bf8bb8f86ed00ea055
humanhash: uranus-king-butter-gee
File name:RFQ Global Trading SPA 03doc.iso
Download: download sample
Signature Loki
Create hunting rule
File size:780'288 bytes
First seen:2020-07-16 18:40:48 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:4hwGQghqzaLhclu893Km8SpZcXiSK8CTqJXWueQbXhWA+x+Fv0nqfzUBeWd+dK4z:UwGQghq3r3/wXf9L8x+QF6
TLSH C1F4BF00DA284CE7DEDD66BAC4949284E6F58C568C0FE64BA7453CD5DF373A2E9032C6
Reporter abuse_ch
Tags:iso Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: General-rading.com
Sending IP: 192.3.3.154
From: Angelo Rota <info@General-rading.com>
Subject: RE: Price Offer and Request for Quotation-General Trading SPA
Attachment: RFQ Global Trading SPA 03doc.iso (contains "RFQ Global Trading SPA 03.img.com")

Loki C2:
http://fixerrors-mail.ml/holy/five/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFL.1579.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bb64ec41dfcfef6520203e2384700c97303c361e12ce9c797658a44b43e2bb89/
Threat name:
ByteCode-MSIL.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 18:42:07 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xnsoyqo7z7xwkibahyryi4ams4ydynq6clhjy6lwlcsewq7cxoeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

iso bb64ec41dfcfef6520203e2384700c97303c361e12ce9c797658a44b43e2bb89

(this sample)

Loki

Executable exe ceeffdff4b0af45c77f3923e47c03a529c87dd4e0e92fdc88b0551857df53239

  
Dropping
MD5 97fe20b35a0fefe732d9cecffb0efe2a
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ceeffdff4b0af45c77f3923e47c03a529c87dd4e0e92fdc88b0551857df53239

Comments