MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4a96008bcadd29dcf55fa718dbab0102d710bfe5bbf21f39796a1061901bced. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f4a96008bcadd29dcf55fa718dbab0102d710bfe5bbf21f39796a1061901bced
SHA3-384 hash: f1d325f168b074baf438d03fcbaf9c05778b1f4989a376908367cfa97883bb97f0669824e60779c12780182ac4ff2fde
SHA1 hash: a639326006604c2b230dca644de4aae4f52beb6d
MD5 hash: 6efa727f55d209bd39630bb43b0a7178
humanhash: johnny-massachusetts-november-violet
File name:attachments.zip
Download: download sample
Signature Loki
Create hunting rule
File size:408'507 bytes
First seen:2020-07-29 06:36:15 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:gaG9k6Hyon+JhtrtE3+3XsQcAqvq0jyjg0IOM:nG91Z2hXADlvfWiZ
TLSH 119423BF641D7D57DFEFA88DC00848F2310A87293346AFFDAA4949C44D9A12D42798D7
Reporter abuse_ch
Tags:HSBC Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: standard13.doveserver.com
Sending IP: 67.220.184.98
From: Forex@hsbc.com
Subject: Payment Advice - Advice Ref:[GLV501756103] / ACH credits / Customer Ref:[KTSB TC3004001 - 086] / Second Party Ref:[1042886P]
Attachment: attachments.zip (contains "SWIFTGLV501756103.xlsm")

Loki payload URL:
http://reklaimapparel.com/wp-admin/js/SWIFTGLV501756103.exe

Loki C2:
http://193.142.59.58/m0ham/pin.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.Macro.Generic.e.24a99813.2252.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f4a96008bcadd29dcf55fa718dbab0102d710bfe5bbf21f39796a1061901bced/
Threat name:
Script-Macro.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 06:38:06 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6suwacf4vxjj3t2v7jyy3ovqcawxcc76lo7sd44xs2qqmgibxtwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f4a96008bcadd29dcf55fa718dbab0102d710bfe5bbf21f39796a1061901bced

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip f4a96008bcadd29dcf55fa718dbab0102d710bfe5bbf21f39796a1061901bced

(this sample)

Loki

Executable exe cb5d91188140efdfc1d20448008a5c8330ab7b8d870eb3a2278caa5d5859577c

Loki

Excel file xlsm e1dbe3338367397078a2e48770e98581226a9658c8812136725368a0c9ed53cd

  
URLhaus
https://urlhaus.abuse.ch/url/421257/
  
Dropping
MD5 1601f9f647a94e8acadd600026087903
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e1dbe3338367397078a2e48770e98581226a9658c8812136725368a0c9ed53cd

Comments