MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2f95ebe98015cd81a530f91c469e70d86307b7769ff25f0f2ac8cea1b3b3df2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2f95ebe98015cd81a530f91c469e70d86307b7769ff25f0f2ac8cea1b3b3df2
SHA3-384 hash: fc9f5935e21fdfe582a1fb859ebaf4f6ce871c68950815307b812f48b1e9b6d711a7cc46054bd5611c444f19359604a5
SHA1 hash: c509c5f59a534a8aa5f1825f050a844f860702a8
MD5 hash: e11f8954911a6ed2139655cc54a7e7f7
humanhash: winner-mockingbird-wolfram-sweet
File name:ЗАПИТВАНЕ ЗА ОФЕРТА 19-10-2020·pdf.zip
Download: download sample
Signature Loki
Create hunting rule
File size:370'638 bytes
First seen:2020-10-19 10:10:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:5K5p5xdtr74gnWbCMb4LjqzbpLDAF47yA+cGMFLZb5IeSHXXygCzI8jlWuAeGik4:Qp5Dp7PWrkcp48yQxDuHXXlysvckn4
TLSH 017423C55762CFB07F69FD935A4FEA22CB74041A36261995E04CA088F4FF67C8E31892
Reporter abuse_ch
Tags:BGR geo Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: svr06.cpanel.hostsg.com
Sending IP: 203.175.174.66
From: SOFIA UNIVERSITY ST. KLIMENT OHRIDSKI <admin@uni-sofia.bg>
Subject: ЗАПИТВАНЕ ЗА ОФЕРТА (SOFIA UNIVERSITY ST. KLIMENT OHRIDSKI) EUI894/BG4633
Attachment: ЗАПИТВАНЕ ЗА ОФЕРТА 19-10-2020·pdf.zip (contains "ЗАПИТВАНЕ ЗА ОФЕРТА 19-10-2020·pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

PUA.Win.Adware.Webalta-6912039-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2f95ebe98015cd81a530f91c469e70d86307b7769ff25f0f2ac8cea1b3b3df2/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 07:18:36 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6l4v5puyafonqgstb6i4i2phbwdda63xnh7sl4hsvsgougz3hxza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f2f95ebe98015cd81a530f91c469e70d86307b7769ff25f0f2ac8cea1b3b3df2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip f2f95ebe98015cd81a530f91c469e70d86307b7769ff25f0f2ac8cea1b3b3df2

(this sample)

Loki

Executable exe 17b27ef0107240e1d2025fcadeeb9f5d6a0b86f4bd6df1af187588c3e04b3b14

  
Dropping
MD5 f23d416004ae999080fbcc3171830371
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 17b27ef0107240e1d2025fcadeeb9f5d6a0b86f4bd6df1af187588c3e04b3b14

Comments