MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb5332943015c660f7db741e0f56b5c6b9861c2b9ab71907dca2cf77aaaa65eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb5332943015c660f7db741e0f56b5c6b9861c2b9ab71907dca2cf77aaaa65eb
SHA3-384 hash: 9ef0b64aefca2523446739dd01b6a6164c945738bfa3886a50b9d86afe9b763f43a03042382624bb14fff8772b4a29a0
SHA1 hash: 685dcc185a8148b676197a9d813daea472a2f5b1
MD5 hash: 1aac13153a9214c46b18a0ce80d9f4b3
humanhash: mississippi-juliet-eight-fix
File name:Updated Offer_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:348'231 bytes
First seen:2020-05-19 04:57:54 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:7w+F9MY6vKqycZVNZzU2x5ztpBhiQsM6U8H9sLMc9M4w0hf0eolDE5SV+5CuMGb8:7dM3dycZVNZzzXTwM6N6Mc9hw0hf0XlL
TLSH B57423F72110A55890BCEAB7C3CBBB5037A047646852A4C4B75BF4E661BCD3B10A87BD
Reporter abuse_ch
Tags:COVID-19 gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: staging.maykenbel.com
Sending IP: 195.12.49.182
From: Alain Foglia MONDODESIGN Ltd <michelle.havari@trends.com>
Reply-To: Alain Foglia MONDODESIGN Ltd <hassanpbc1@gmail.com>
Subject: Face Mask with high quality (Civil /KN95 /3D-KN95 /Medical/Surgical/N95/Children Mask)
Attachment: Updated Offer_pdf.gz (contains "gunzipped")

Loki C2:
http://missingandfound.com.my/limit/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.BehavesLike.Win32.AdwareDealPly.bc.5405.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 05:36:16 UTC
File Type:
Binary (Archive)
Extracted files:
286
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7njtffbqcxdgb563oqpa6vvvy24ymhbltk3rsb64ulhxpkvkmxvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz fb5332943015c660f7db741e0f56b5c6b9861c2b9ab71907dca2cf77aaaa65eb

(this sample)

Loki

Executable exe ba22cb6395d1086b8acc539f7c514b21fca565d0da8c9e34daf0aee9b68b170a

  
Dropping
MD5 ed03c5322c282abaa6a3fcbbbad63d5a
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ba22cb6395d1086b8acc539f7c514b21fca565d0da8c9e34daf0aee9b68b170a

Comments