MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce1fc701951013be927cdc89ed3cf79d9530fbcf8149f160cc2158aebd166ec8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce1fc701951013be927cdc89ed3cf79d9530fbcf8149f160cc2158aebd166ec8
SHA3-384 hash: c9d625fc985b93b8a9f61c6e13d452eaec5f14a0a2cce104da3121759756f9132cf57cb258ded8761755d8211f2e8f67
SHA1 hash: 3c1f4f7a15de99ecc5618818a3832a88dde9e4df
MD5 hash: 1e563c37f2ef625561203db86fb1677f
humanhash: enemy-ack-six-black
File name:Bảng báo giá 18-01-2021.pdf.rar
Download: download sample
Signature Loki
Create hunting rule
File size:204'887 bytes
First seen:2021-01-18 08:18:32 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:a5jwnrz4g1kBGJAsd6CLiFnE3O8j28BvSIZ:a5jo/4g1Mh5E3phSIZ
TLSH 76142276B3C4442D4B5BF3F0287A9C7201E374D87C395470660EBEAB6836655B02EF6A
Reporter abuse_ch
Tags:geo Loki rar VNM


Avatar
abuse_ch
Malspam distributing Loki:

HELO: svr105.phsserver.net
Sending IP: 203.175.162.90
From: ĐẠI HỌC QUỐC GIA TP. HỒ CHÍ MINH <admin@vnuhcm.edu.vn>
Subject: Bảng báo giá (ĐẠI HỌC QUỐC GIA TP. HỒ CHÍ MINH) EUI894/BU400
Attachment: Bảng báo giá 18-01-2021.pdf.rar (contains "cryptered_pdf.exe")

Loki C2:
http://51.195.53.221/p.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce1fc701951013be927cdc89ed3cf79d9530fbcf8149f160cc2158aebd166ec8/
Threat name:
Win32.Trojan.Symmi
Create hunting rule
Status:
Malicious
First seen:
2021-01-18 08:19:05 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zyp4oamvcaj35et43se62phxtwktb66pqfe7cygmefmk5piwn3ea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ce1fc701951013be927cdc89ed3cf79d9530fbcf8149f160cc2158aebd166ec8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar ce1fc701951013be927cdc89ed3cf79d9530fbcf8149f160cc2158aebd166ec8

(this sample)

Loki

Executable exe 3b48b4545b03a7ac40cc35e3a9d50e5be1374527dcb4848530249b2d62b243c6

  
Dropping
MD5 a3a16b2cf441a00b825c047f2506c1bb
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3b48b4545b03a7ac40cc35e3a9d50e5be1374527dcb4848530249b2d62b243c6

Comments