MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4e2f6c5870b88bc381239e1d38f595046485e1f1e3e3c3986a5fcc76bcc7571. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f4e2f6c5870b88bc381239e1d38f595046485e1f1e3e3c3986a5fcc76bcc7571
SHA3-384 hash: 14b200ad1473f56942be8a1875a345979785ed25cbfca4a143db2421810d3530de6a9f6bbe2277870f69b11b20489863
SHA1 hash: 80d7ea7dca80d5251117774270c8017b8fd0775b
MD5 hash: 90668cf8051ba2b67baea73c1188ff99
humanhash: nitrogen-oregon-jig-robin
File name:Stampa_REFVS03237_7567SS.iso
Download: download sample
Signature Loki
Create hunting rule
File size:409'600 bytes
First seen:2021-01-19 17:52:06 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:T1rCpB4pOb91k1c7xYTjmM486X4txD6ocNkjHg3LB3:BCpBFbbRXMS46VkA7B
TLSH 6694F19AB684CA30C0A481B99D95D4E92A2B2CA8DB65408773DD3FBF377F450D139B1C
Reporter abuse_ch
Tags:geo iso ITA Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: banca.mps.it
Sending IP: 103.139.45.164
From: Banca Monte dei Paschi di Siena <documentl@banca.mps.it>
Subject: Re: Banca bonifico copia
Attachment: Stampa_REFVS03237_7567SS.iso (contains "Stampa_REFVS03237_7567SS.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
204
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader36.36420.6787.11397.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f4e2f6c5870b88bc381239e1d38f595046485e1f1e3e3c3986a5fcc76bcc7571/
Threat name:
Win32.Trojan.Zenpak
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 17:53:04 UTC
AV detection:
9 of 45 (20.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6trpnrmhboelyoashhq5hd2zkbdeqxq7dy7dyomgux6mo26movyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f4e2f6c5870b88bc381239e1d38f595046485e1f1e3e3c3986a5fcc76bcc7571

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

iso f4e2f6c5870b88bc381239e1d38f595046485e1f1e3e3c3986a5fcc76bcc7571

(this sample)

Loki

Executable exe 9d68a12426cf5945a7f852ad0ebfb745858e80a10368e5ef9468030fa95363e4

  
Dropping
MD5 29233511bddcc3dfb1a9eb45e510dabb
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9d68a12426cf5945a7f852ad0ebfb745858e80a10368e5ef9468030fa95363e4

Comments