MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cad82146593f92964ba2d0ad421c4592f7659c11852b82265594b4b056a46ec8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cad82146593f92964ba2d0ad421c4592f7659c11852b82265594b4b056a46ec8
SHA3-384 hash: 78d3a70ce01055b2a901b33ecadb7eeff9603bc20d01ea8e5c44f048cb5a00095a484cc5befb71201555e9154ae2c85c
SHA1 hash: 6648dfc77a832f4a9c5db98a9808529146248309
MD5 hash: 12b9948d6ab88169058c908c61115f1b
humanhash: blossom-butter-beryllium-monkey
File name:STS CARGO SHIPMENT.gz
Download: download sample
Signature Loki
Create hunting rule
File size:201'866 bytes
First seen:2021-01-11 08:15:54 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 3072:D11SNqQczh+73Uuo7yE35NYgutnUXrtHebyeRadrbFb6fUBYzPC5QyTCx25T9:D7OqQqT5GgcQtHSyuoQ4Yz66/E5B
TLSH 0314132520A67C6C61FA4C11589F3AD7EA25D06849EC5BF3484F1EB8AB28C4DDD8F437
Reporter abuse_ch
Tags:DHL gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: hrl.comsats.net.pk
Sending IP: 203.124.39.163
From: Umer Tariq (DHL PK) <atiqa@rdlpk.com>
Subject: RE: REQUIRE MAWB
Attachment: STS CARGO SHIPMENT.gz (contains "STS CARGO SHIPMENT.exe")

Loki C2:
http://truantinmobiliaria.com.ar/zk/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.45423975.15120.6921.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cad82146593f92964ba2d0ad421c4592f7659c11852b82265594b4b056a46ec8/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-01-11 08:16:06 UTC
AV detection:
12 of 44 (27.27%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zlmccrszh6jjms5c2cwuehcfsl3wlharquvyejsvss2lavven3ea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cad82146593f92964ba2d0ad421c4592f7659c11852b82265594b4b056a46ec8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz cad82146593f92964ba2d0ad421c4592f7659c11852b82265594b4b056a46ec8

(this sample)

Loki

Executable exe 400f9673e8739dbce3f10c37b62e93789563acd0a57364e7c6cbc841eaac9696

  
Dropping
MD5 df0bbbf12771529bfe66b2ba71d1e1f1
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 400f9673e8739dbce3f10c37b62e93789563acd0a57364e7c6cbc841eaac9696

Comments