MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed55cd272a6480a027fd31c32e5b8828165a23e9cc445fc216d2ccba0b08e9c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed55cd272a6480a027fd31c32e5b8828165a23e9cc445fc216d2ccba0b08e9c1
SHA3-384 hash: fd7b8ebd7e25eeaea10e8b0b3c44259547ed11e36f2b6b7423dc1ff783a92f782c5d20fd9e9704fcb4d52c9421052660
SHA1 hash: 6c94b843c1191524b8b7f8f24851fdbd191ff0a0
MD5 hash: 68204109ae4098b505582929fb3ce96f
humanhash: eighteen-yellow-moon-network
File name:T T πληρωμή 11.631,35 ευρώ.r13
Download: download sample
Signature Loki
Create hunting rule
File size:420'858 bytes
First seen:2021-01-15 15:54:55 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:WWXlaXMFL4jLeYkXUX75hgtUMfIbrQkWp/WfZo7H5tj1PgOtD168MQBPY4gw9ti3:W2lF4jLtQc75GOMIrQ7p/eZAX9tiMFVS
TLSH 7594234897D1B674B787F3BA004BBB1E374E0BCCC8A84925837248D93999C65F61D86F
Reporter abuse_ch
Tags:geo GRC Loki r13


Avatar
abuse_ch
Malspam distributing Loki:

HELO: zephir.ph
Sending IP: 45.137.22.41
From: Prive Irene Moutsoyiannis <info@zephir.ph>
Subject: T / T πληρωμή 11.631,35 ευρώ
Attachment: T T πληρωμή 11.631,35 ευρώ.r13 (contains "T T πληρωμή 11.631,35 ευρώ.exe")

Loki C2:
http://becharnise.ir/fa2/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
190
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ed55cd272a6480a027fd31c32e5b8828165a23e9cc445fc216d2ccba0b08e9c1/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-15 11:25:38 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5vk42jzkmsakaj75ghbs4w4ifalfui7jzrcf7qqw2lglucyi5haq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ed55cd272a6480a027fd31c32e5b8828165a23e9cc445fc216d2ccba0b08e9c1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar ed55cd272a6480a027fd31c32e5b8828165a23e9cc445fc216d2ccba0b08e9c1

(this sample)

Loki

Executable exe 51146cdc626be707700c7459883faef7864612af14354aefed988fed9afa136f

  
Dropping
MD5 77c712dbe9016d578289922f9e9ee6d9
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 51146cdc626be707700c7459883faef7864612af14354aefed988fed9afa136f

Comments