MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e2104b9732ad8280edd6b9ef56987ceb457ecd753d646708a0f1dcff368f71b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e2104b9732ad8280edd6b9ef56987ceb457ecd753d646708a0f1dcff368f71b7
SHA3-384 hash: a15ccc04568bce501aaa04b9767c49ddb40e90f5391c50dcf6684edb5c45cb6d56dc650fa63a2d617cb51756f891a136
SHA1 hash: df8064b8fb19760252a1cf1b90551263131808c8
MD5 hash: 698c4bf431fd5a6fe0a9b184c48adc6e
humanhash: princess-don-quebec-august
File name:SEP, OCT NOV SOA----WWP SHA.zip
Download: download sample
Signature Loki
Create hunting rule
File size:211'916 bytes
First seen:2020-12-09 11:04:22 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:9nh6hZ3QpgJBOm+m58uluzqhqBjr77pZou6UWbQiYUhtTI0J+tXo1r1YpOeEA31y:Fh6TBOjs8ulA1z7zWUif0KripBE+xTS
TLSH 322412AD73468F2AF7D3982B1AA046BEC32B1FC2519BDD667D2B0FC0E92765C4431491
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.it-lab.md
Sending IP: 79.140.160.80
From: Sophia Yang <steodorescu@cricova.md>
Subject: SEP, OCT & NOV SOA----WWP SHA
Attachment: SEP, OCT NOV SOA----WWP SHA.zip (contains "SEP, OCT & NOV SOA----WWP SHA.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.Generic-S.26554.32047.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e2104b9732ad8280edd6b9ef56987ceb457ecd753d646708a0f1dcff368f71b7/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4iiexfzsvwbib3owxhxvngd45ncx5tlvhvsgocfa6hop6nupog3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e2104b9732ad8280edd6b9ef56987ceb457ecd753d646708a0f1dcff368f71b7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip e2104b9732ad8280edd6b9ef56987ceb457ecd753d646708a0f1dcff368f71b7

(this sample)

Loki

Executable exe 1b730f958076e33d4a05e368760d7f28b04a4f745dbc67140247de91cd34942c

  
Dropping
MD5 cc6ae23665c9c66e8a09888e0422f47c
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1b730f958076e33d4a05e368760d7f28b04a4f745dbc67140247de91cd34942c

Comments