MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd723fe7161259d8df2a256dcb8e171a549e5c772cfada8fa001e38379e1f2bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd723fe7161259d8df2a256dcb8e171a549e5c772cfada8fa001e38379e1f2bf
SHA3-384 hash: f82c79b13a4a343286c57ecea0a124a533287b3167cf43a3fed9711a55335c96d288b649279646200fd00051624d19b4
SHA1 hash: 2f9b624a097d484a4e26580dc86bdb5e881f1dbf
MD5 hash: d5dff08c10d226de78c576e0c6d4c0f7
humanhash: montana-william-illinois-berlin
File name:Nakupna objednavka_P.O no 4019013,pdf.iso
Download: download sample
Signature Loki
Create hunting rule
File size:835'584 bytes
First seen:2020-10-15 13:08:43 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:yywTFD6r91Yk/yHVMSVBltzbGmbaLd7OzlpUxLjbirK:Qgp1Yk2MEltHfGLdefU8r
TLSH 8E059E73F2A14837C1E31E389C3F9B689D27BE102A35B9562BF91D4C9F396407925293
Reporter abuse_ch
Tags:geo iso Loki SVK


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.saldus.lv
Sending IP: 195.13.214.8
From: TPV Technology s.r.o. <katairna.poliakova@tpvtechnology.sk>
Subject: Re: Nákupná objednávka / P.O n.º 40190132
Attachment: Nakupna objednavka_P.O no 4019013,pdf.iso (contains "Nakupna objednavka_P.O no 4019013,pdf.exe")

Loki C2:
http://xcpx.xyz/V3/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.BackDoor.SpyBotNET.25.21088.18222.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bd723fe7161259d8df2a256dcb8e171a549e5c772cfada8fa001e38379e1f2bf/
Threat name:
Win32.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-15 11:43:57 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xvzd7zywcjm5rxzkevw4xdqxdjkj4xdxft5nvd5aahryg6pb6k7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bd723fe7161259d8df2a256dcb8e171a549e5c772cfada8fa001e38379e1f2bf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

iso bd723fe7161259d8df2a256dcb8e171a549e5c772cfada8fa001e38379e1f2bf

(this sample)

Loki

Executable exe 5496701dc86ff097805172b25b896ef1f819fd4949d6ec52ec343493e03f27ca

  
Dropping
MD5 4a086bbd9d947bee75a0de551882aecb
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5496701dc86ff097805172b25b896ef1f819fd4949d6ec52ec343493e03f27ca

Comments