MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf85acb9f6732b72874395e9362600e2fe129e6988faea6ddd7a8f957161fbf4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf85acb9f6732b72874395e9362600e2fe129e6988faea6ddd7a8f957161fbf4
SHA3-384 hash: e38b4050f438833c40356a19fc0d2f8214558cf46e771e411f8bd77c8126adaf706529a993f137d75bcf8f99372822b6
SHA1 hash: 82c443061867dfe96df7afda6b15f7a62a61d225
MD5 hash: ca80218725bf221e37f70f9c6c5f6ca4
humanhash: march-florida-video-ohio
File name:REVISED INVOICE USD760,223.00_PDF.arj
Download: download sample
Signature Loki
Create hunting rule
File size:833'140 bytes
First seen:2020-05-11 06:17:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:TSOg5BZf1k20SIXm4d14OpYJw3cEDDMZeo40EJHIpW:TSTPfBo2EnpB37Dueo40aopW
TLSH 2405234BD0FDD43B00DC272544E545244FFBE9C52B82BDA7F376A48E86E198AAE109B1
Reporter jarumlus
Tags:Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 21:09:00 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
14 of 30 (46.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z6c2zopwomvxfb2dsxutmjqa4l7bfhtjrd5ou3o5pkhzk4lb7p2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip cf85acb9f6732b72874395e9362600e2fe129e6988faea6ddd7a8f957161fbf4

(this sample)

Loki

Executable exe 4bc494204a6950d07cdbc7181b7b9588d037d7118e31fb41f0156c2b44423e34

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4bc494204a6950d07cdbc7181b7b9588d037d7118e31fb41f0156c2b44423e34
  
Dropping
MD5 5dfa96941d8503287771d954e25c343f

Comments