MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df651c546332115b5957d1c78e65bc1c89381231d148a7f65e2efd37fe6a50a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: df651c546332115b5957d1c78e65bc1c89381231d148a7f65e2efd37fe6a50a1
SHA3-384 hash: f16ce6cbcb432cdc74c28bc0b9ab87805eef7a77801c01150af35a0233f970386407086ccea273070f3b8a8ab82cbaa6
SHA1 hash: 9fd161251c6e1f363861c8ac0a0139e346cce31f
MD5 hash: 83dec29916f183d6ee10057794ecda91
humanhash: utah-georgia-harry-three
File name:2004270BCVXO_PDF.gz
Download: download sample
Signature Loki
Create hunting rule
File size:337'700 bytes
First seen:2020-05-06 10:48:10 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:RbaaiynzqBcZ6IGZK3Z/Ezk9QlJx13hnUfvEP1yP:Rbd3z3/3Zgk9kv1dUEPI
TLSH AD742352ED5DC79C61E59B8A3471AB1FB7A2C2C35E4A4196A32DC0894ACE3C0C57CC7E
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: cross.net.id
Sending IP: 137.59.13.130
From: K-eDocument <risal@mks.cross.net.id>
Reply-To: K-eDocument <ricknicolas.aol@hotmail.com>
Subject: Credit Advice (Inward Remittance)
Attachment: 2004270BCVXO_PDF.gz (contains "2004270BCVXO_PDF.exe")

Loki C2:
http://missingandfound.com.my/mb/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-1
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.Nanocore.23.31273.12919.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 14:11:23 UTC
File Type:
Binary (Archive)
Extracted files:
40
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=35sryvddgiivwwkx2hdy4zn4dsetqerr2fekp5s6f36tp7tkkcqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz df651c546332115b5957d1c78e65bc1c89381231d148a7f65e2efd37fe6a50a1

(this sample)

Loki

Executable exe bfc99afb39a2d70d500ab264de8b0bc112f586f675d6ec1ff2c186020e6af100

  
Dropping
MD5 f3ba06eff03a4d1951da70b20f991cba
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bfc99afb39a2d70d500ab264de8b0bc112f586f675d6ec1ff2c186020e6af100

Comments