MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c72c37d2fb98a91c32e8829277237210745402730b15dafbfddffe2818728bca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c72c37d2fb98a91c32e8829277237210745402730b15dafbfddffe2818728bca
SHA3-384 hash: 5eb01cdc973d26af95984c02cdca89d0bbf92348d03e4a80a65fce6dc78ebba5b07478269bb5136189c4259e8cce382f
SHA1 hash: ffe42ec129774789a7d45f5385ec3c869c03259a
MD5 hash: decfb4ec5afd76ec996e48cd91536d9a
humanhash: table-yankee-jupiter-three
File name:Encomenda_TR-08839-9AG.zip
Download: download sample
Signature Loki
Create hunting rule
File size:1'117'967 bytes
First seen:2020-05-20 07:33:30 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:NVR37qRladPZPp/y9QkKbO/vu4QCkx+WCE5sLLkVCJ8Fl+ojDZfKCjH:NVR3OLaNz7LiucLkPH+ofY6
TLSH AB3533FAD08E6CDEE7E17D3DEB56A4CA949128AFE965423B5D004811DE8305F01B8DA3
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.llkc.lv
Sending IP: 80.232.172.84
From: Armando Melo <m.armando@multifluido.com>
Subject: R: Encomenda_TR-088399AG
Attachment: Encomenda_TR-08839-9AG.zip (contains "Encomenda_TR-08839-9AG.exe")

Loki C2:
http://focal-com.me/P1/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 07:36:49 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y4wdpux3tcurymxiqkjhoi3scb2fiattbmk5v675377cqgdsrpfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip c72c37d2fb98a91c32e8829277237210745402730b15dafbfddffe2818728bca

(this sample)

Loki

Executable exe b6423a90227ed2d30952943cdfc63e4f31b2c79a15f80e5f2fb6aa9efb75dcbe

  
Dropping
MD5 10e9f2787ea44f79b805208d2de5e467
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b6423a90227ed2d30952943cdfc63e4f31b2c79a15f80e5f2fb6aa9efb75dcbe

Comments