MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cacfda9d47a1f9d34eb0ab4cc6a178bb25fd999da5eb0fbbd2de7bfadbd4ae0b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cacfda9d47a1f9d34eb0ab4cc6a178bb25fd999da5eb0fbbd2de7bfadbd4ae0b
SHA3-384 hash: a5b43cd11c3875e18d8be505c2da83746fadcd50ea908fffa986de0801a1bee540bc528076cb3a35f137b5720913f9da
SHA1 hash: 094515ad2b4999d044d648f51a8c94821950a370
MD5 hash: 2891e99c9e34ed2f63a8fdea086163e1
humanhash: missouri-rugby-chicken-coffee
File name:Scan Copy-SOA March 20_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:380'761 bytes
First seen:2020-05-05 07:24:40 UTC
Last seen:2020-05-05 07:27:04 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:xXTbongdPVrj9j0r6DuaHdGL7GzCOJx5ilw//nDQdpI3qDfIxA47duYJWoskju:NogdZ9c6DjHddOOJmw//Dy+3qDytrJjC
TLSH D78423E5A59A2E4434BD5F7B1D8CE1A50C56904EBB4CCDBD055E02C1B209DBEBEA3B02
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: fsds.kz
Sending IP: 103.133.105.64
From: FSDS GROUP RUSSIA <e.kvashnina@fsds.kz>
Subject: MAR.2020: The statement of MAR.2020 Remitttance
Attachment: Scan Copy-SOA March 20_pdf.gz (contains "Scan Copy-SOA March 20_pdf.exe")

Loki C2:
http://broken1.cf/L5/fre.php

Intelligence

File Origin
# of uploads :
3
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.Nanocore.23.929.31112.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 02:32:43 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
34 of 48 (70.83%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zlh5vhkhuh45gtvqvngmnilyxms73gm5uxvq7o6s3z57vw6uvyfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip cacfda9d47a1f9d34eb0ab4cc6a178bb25fd999da5eb0fbbd2de7bfadbd4ae0b

(this sample)

Loki

Executable exe 31f81e12e9b5ab050a4568992bd08c9a7037c39638d124a0c74aedbc610cbb63

  
Dropping
MD5 fd8c9c773ca154e9f586caa7a5fd603f
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 31f81e12e9b5ab050a4568992bd08c9a7037c39638d124a0c74aedbc610cbb63

Comments