MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef0dc49e496b786ad799829edc5feeb4c42131c393b4be95e42ec790a5c67905. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef0dc49e496b786ad799829edc5feeb4c42131c393b4be95e42ec790a5c67905
SHA3-384 hash: 7eb5eadda7f880d20d504da02941b57fdcc66a50ee4bfc2a086f50a9788c4103a5940002159ef2e2cc5b066f0a09fe72
SHA1 hash: 35e6104c6539d60a7200ce4fc1e0cba7a0641997
MD5 hash: 93f72d81089d98ca091da4baa4b4bf6d
humanhash: mexico-minnesota-bulldog-mango
File name:Payment Advice TT copy_pdf.arj
Download: download sample
Signature Loki
Create hunting rule
File size:381'922 bytes
First seen:2020-08-13 09:19:48 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:YcOIttBQUmiyI+h7eJN7DmGizkFe9KmOCOpim8kvL/52DnEAGQf9Pii9qwHoj1z:bLQUmDhy/PokQImkLvjMova9PiikwHa
TLSH 148423365A120391B028D5A1F7B33B7B6A36DECC0039FDC489DA6696376DC9906DF384
Reporter abuse_ch
Tags:arj Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: infonet.com.vn
Sending IP: 162.144.74.195
From: Oversea sale Department <winstar10@wsdlogistics.com>
Subject: BALANCE PAYMENT SWIFT
Attachment: Payment Advice TT copy_pdf.arj (contains "Statement of Account.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Mal.Generic-S.5549.16169.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef0dc49e496b786ad799829edc5feeb4c42131c393b4be95e42ec790a5c67905/
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 09:21:06 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=54g4jhsjnn4gvv4zqkpnyx7owtcccmodso2l5fpef3dzbjogpecq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ef0dc49e496b786ad799829edc5feeb4c42131c393b4be95e42ec790a5c67905

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip ef0dc49e496b786ad799829edc5feeb4c42131c393b4be95e42ec790a5c67905

(this sample)

Loki

Executable exe 56becf60cf203dcfd2661caea898181a03d22d5d0f3c46902aa32abbc04d2e25

  
Dropping
MD5 474ac59f3d5b72e956d64049dc2131ab
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 56becf60cf203dcfd2661caea898181a03d22d5d0f3c46902aa32abbc04d2e25

Comments