MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd9b72adcf6ab2d5b76f4551d3cf39d8bb6a7fd72d26d2769564cfd0ceb94e8e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd9b72adcf6ab2d5b76f4551d3cf39d8bb6a7fd72d26d2769564cfd0ceb94e8e
SHA3-384 hash: 8c03b3c6b967702847a391fc6bc26dca9d9708e20520ebd742a4f5fdbcd94a272b28be9f31864addd0e3bd2d0e02a6bb
SHA1 hash: 16cbcecba619d17cc6f542e359deeec3539b0c76
MD5 hash: 19db1a290a63f9111697ad55ed650f5b
humanhash: hawaii-delaware-summer-happy
File name:REF INQUIRY4593.zip
Download: download sample
Signature Loki
Create hunting rule
File size:365'082 bytes
First seen:2020-10-20 11:48:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:HCIpG9OxORqVFhh/RRXmpPo8ScEXntYMei1QYSfe9dok8r:iI4gXnQ5ytYMX1P9qk8r
TLSH F274234CBDF0C4069930226F5557A90D1DE8ADE1CB63ACF4E97F1172C8A81A9CC9877D
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: multiimpact.com.my
Sending IP: 192.236.146.195
From: MS ATIKAH <sales@multiimpact.com.my>
Subject: Re: MULTI-IMPACT/INQUIRY ORDER
Attachment: REF INQUIRY4593.zip (contains "REF# INQUIRY4593.exe")

Loki C2:
http://mecharnise.ir/eb2/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

PUA.Win.Adware.Webalta-6912039-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd9b72adcf6ab2d5b76f4551d3cf39d8bb6a7fd72d26d2769564cfd0ceb94e8e/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 10:36:35 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3wnxflopnkznln3pivi5htzz3c5wu76xfutne5uvmth5btvzj2ha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dd9b72adcf6ab2d5b76f4551d3cf39d8bb6a7fd72d26d2769564cfd0ceb94e8e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip dd9b72adcf6ab2d5b76f4551d3cf39d8bb6a7fd72d26d2769564cfd0ceb94e8e

(this sample)

Loki

Executable exe a55d6d38e7797634af9612af2a33672ea5cdb86dbdbe60b241e070a9abe96719

  
Dropping
MD5 d19f29cc0a3630336eb8926e70f74da0
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a55d6d38e7797634af9612af2a33672ea5cdb86dbdbe60b241e070a9abe96719

Comments