MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0b07cb32ab3399e83bcc7fd1c507320bff028bb6bfed253ec807767de44780a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d0b07cb32ab3399e83bcc7fd1c507320bff028bb6bfed253ec807767de44780a
SHA3-384 hash: 9d6e68fc9fbd3d8db3f6910ae276e9ac636ebfbe8b68b82fb41604d85e0e84493417631665036339ed61701899fb0bbe
SHA1 hash: 0e3726c82fdf747ed555eb9312ce150701d821f1
MD5 hash: fde15e917f98e41e6ad7f77030897813
humanhash: monkey-bravo-six-mountain
File name:Basf 180827.img
Download: download sample
Signature Loki
Create hunting rule
File size:313'344 bytes
First seen:2021-02-11 10:09:19 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:3pV+OJ0qvtMWjQ/THTmUzoOJPVsR4DdYllSuQRnu0x:3pV+M0qeVmU0YPV44ilQ5
TLSH 18649C6232F28F50C4FF0AF88852D1B64B757D819DF8D6EF2B4D1A48576AA402F19372
Reporter abuse_ch
Tags:img Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: basf.com
Sending IP: 45.133.203.49
From: Arpad Szollosi <arpad.szollosi@basf.com>
Subject: Basf Purchase Order 180827
Attachment: Basf 180827.img (contains "Basf 180827.exe")

Loki C2:
http://hettichlab.cf/h1/stev/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.3243.26859.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d0b07cb32ab3399e83bcc7fd1c507320bff028bb6bfed253ec807767de44780a/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2021-02-11 19:09:17 UTC
AV detection:
12 of 47 (25.53%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2cyhzmzkwm4z5a54y76ryudtec77akf3np7neu7mqb3wpxsepafa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

img d0b07cb32ab3399e83bcc7fd1c507320bff028bb6bfed253ec807767de44780a

(this sample)

Loki

Executable exe 15ba2bab75f67a57d7d465781d76e5165a2c2307bad1ec07fa5150c16fcfa782

  
Dropping
MD5 20de0b9837a31660b088770c359159fc
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 15ba2bab75f67a57d7d465781d76e5165a2c2307bad1ec07fa5150c16fcfa782

Comments