MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2e1e7ca88d98431870767578a0fc71fb83cd6daed49ada8b4f8496d0f833f15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2e1e7ca88d98431870767578a0fc71fb83cd6daed49ada8b4f8496d0f833f15
SHA3-384 hash: b73451cca154b294e730c8e555ea9662a91f07c29067ab63879d01e215a942db89a61c7bdbce0fa3ccf9f3aa8a5acfc5
SHA1 hash: 1e417f2fcd9718d38e13d72cea6e98d4123dd496
MD5 hash: 0b77983e450991c6626ba487f5dc3578
humanhash: ten-victor-cold-solar
File name:Grupo Dani Order_pdf.zip
Download: download sample
Signature Loki
Create hunting rule
File size:302'944 bytes
First seen:2020-10-29 06:16:08 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:qBdk0k8xz3pRfSrKRxck8SDPT5RThKyFWbh5r7nRzl8QB:U/k8xjw6LT5RThKZhR38QB
TLSH BF54238A1E362DDB9A4E34B58EBD8895927FA136DCF47F4C52C5EE312B3D502DC12182
Reporter cocaman
Tags:Loki zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Marcello Prieto<logistics@staunchondemand.com>"
Received: "from staunchondemand.com (unknown [185.125.204.39]) "
Date: "28 Oct 2020 20:21:04 -0700"
Subject: "Fwd: Re: New Order Inquiry Grupo Dani Chile"
Attachment: "Grupo Dani Order_pdf.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2e1e7ca88d98431870767578a0fc71fb83cd6daed49ada8b4f8496d0f833f15/
Threat name:
ByteCode-MSIL.Trojan.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-29 04:59:25 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6lq6psui3gcddbyhm5lyud6hd64dzvw25ve23kfu7bew2d4dh4kq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip f2e1e7ca88d98431870767578a0fc71fb83cd6daed49ada8b4f8496d0f833f15

(this sample)

Loki

Executable exe aa458271d21aa803973dd66d28e10a031d03809a810fd91d1eaa7fcdeea85ef4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 aa458271d21aa803973dd66d28e10a031d03809a810fd91d1eaa7fcdeea85ef4
  
Dropping
Loki

Comments