MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9f81f0360ec23fc179e8230704da6f9128fd7ae07cfaebb973a2d0479d6421a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c9f81f0360ec23fc179e8230704da6f9128fd7ae07cfaebb973a2d0479d6421a
SHA3-384 hash: 68b80a86140b0f5168d38a90d3e801be7545a578443d117130f0263e6822286a1b93b83e36665f1beba999ce60688f1a
SHA1 hash: 74c588675a063145056e9c51dc54fa1c366f632e
MD5 hash: d7024ae84c9e72750def2d57977a6699
humanhash: low-happy-echo-kitten
File name:ANIS COFFEE SDN. BHD.zip
Download: download sample
Signature Loki
Create hunting rule
File size:189'367 bytes
First seen:2020-05-11 14:07:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:HKkh2rMNnNtZeLNB68Kj5kiaL99yXBSSgyyIaw8egn/btiDNJH6lXlz68Yh2RFJc:HNUYN/ZeLOELmXcSgyHPcTtiDX0V229c
TLSH DE041236727333F24F23E099DB8281C66523EB51CF55C4EA97A85F2468CF588817A8DD
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: euskoauto.vservers.es
Sending IP: 188.164.198.145
From: AMACC Corporate Services <collection@amacc.com.my>
Subject: Statement Of Account
Attachment: ANIS COFFEE SDN. BHD.zip (contains "ANIS COFFEE SDN. BHD..exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 14:18:54 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zh4b6a3a5qr7yf46qiyhatng7eji7v5oa7h25o4xhiwqi6owiina._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip c9f81f0360ec23fc179e8230704da6f9128fd7ae07cfaebb973a2d0479d6421a

(this sample)

Loki

Executable exe 58fa191f38b25cab67921a0f3c0aba75e5254ca139733df9dca6eec26fae1377

  
Dropping
MD5 81c7e01f5175b8a1ac4a5b15d4bcddbd
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 58fa191f38b25cab67921a0f3c0aba75e5254ca139733df9dca6eec26fae1377

Comments