MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9424a24a3f6e952e28aede4341f5529a777c9a25bb16795631efdfb3f0cd3e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c9424a24a3f6e952e28aede4341f5529a777c9a25bb16795631efdfb3f0cd3e1
SHA3-384 hash: b1e397206fc28617f0b4adde0e37a576ab5583fd57a72a016fcddcd8ce61b24d7d920e9f7766a519e6483504e2c6d43d
SHA1 hash: a63716a337b538444c43dad03f4f777181424bd5
MD5 hash: e0ceba657f547a8b85f44c2f6401fba4
humanhash: asparagus-early-oklahoma-lion
File name:Nuevo pedido fibra.pdf.z
Download: download sample
Signature Loki
Create hunting rule
File size:366'526 bytes
First seen:2020-10-15 10:44:22 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:X3hO1HoBB2uHKRn7BmB5YMvDLrOcxYZgr2wRkKb96IJ7a2DW5/gg4mwj2LtpzmH8:X3QUnHKRn7BmjVxKw6S6I57M4aLzny0
TLSH E974236CFA7AFC2FD0CB9BB14A93B277237CD9781D32A4A2AC3015413C5A521179E4E5
Reporter abuse_ch
Tags:Loki z


Avatar
abuse_ch
Malspam distributing Loki:

HELO: correo.netgate.com.uy
Sending IP: 200.40.119.41
From: Diego Zalazar | KOPELCO <dzlazar@kopelco.co>
Subject: Nuevo pedido fibra
Attachment: Nuevo pedido fibra.pdf.z (contains "Nuevo pedido fibra.pdf.exe")

Loki C2:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c9424a24a3f6e952e28aede4341f5529a777c9a25bb16795631efdfb3f0cd3e1/
Threat name:
Win32.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 17:05:32 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zfbeujfd63uvfyuk5xsdih2vfgtxpsncloywpfldd367wpym2pqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c9424a24a3f6e952e28aede4341f5529a777c9a25bb16795631efdfb3f0cd3e1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z c9424a24a3f6e952e28aede4341f5529a777c9a25bb16795631efdfb3f0cd3e1

(this sample)

Loki

Executable exe 42f4386f5305e6f62fe23fb2e10121f54b55d4968317ab506542c285020f7beb

  
Dropping
MD5 7d022bd261d20987a83419b510539775
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 42f4386f5305e6f62fe23fb2e10121f54b55d4968317ab506542c285020f7beb

Comments