MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f9093429b52b5ef27a07ff7aa73890a15373c591f40729f406fc22cb26e6112. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f9093429b52b5ef27a07ff7aa73890a15373c591f40729f406fc22cb26e6112
SHA3-384 hash: 6e4899849d1e50dd0429cf23a77908a3d196bb6436811a44bbef7cf849a9caf234c64e97d812b85503775b7aeaee0d24
SHA1 hash: c94daea458ff785830a23e51341a9a2f694b0a4f
MD5 hash: 668288212aefcb19696e9937e2aa60b9
humanhash: sodium-golf-william-jupiter
File name:444400.r00
Download: download sample
Signature Loki
Create hunting rule
File size:789'859 bytes
First seen:2020-08-19 11:16:44 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:qavtfFCJqSkpaUyRS8oxPce+L1lN1Qf/qb8hL6cklSCa6kRcwLRx4Gz5lwK6iK:qC1sJRS8o1UbN1QnqbieckWzz5jK
TLSH 8CF433F01704E60F72FAC3AF0179CC64A0B35FDAB10B54A1F39A967E16BAA0748F5561
Reporter abuse_ch
Tags:DHL Loki r00


Avatar
abuse_ch
Malspam distributing Loki:

HELO: swn0.721.zazomika.ml
Sending IP: 178.62.210.203
From: DHL Express<NoReply.ODD@dhl.com>
Subject: YOUR DELIVERY IS TODAY
Attachment: 444400.r00 (contains "444400.exe")

Loki C2:
http://193.142.59.18/mc1/3/pin.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f9093429b52b5ef27a07ff7aa73890a15373c591f40729f406fc22cb26e6112/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 11:18:09 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d6ijgqu3kk266j5ap732u44jbiktopczd5ahfh2an7bczmtomeja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1f9093429b52b5ef27a07ff7aa73890a15373c591f40729f406fc22cb26e6112

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

r00 1f9093429b52b5ef27a07ff7aa73890a15373c591f40729f406fc22cb26e6112

(this sample)

Loki

Executable exe fc1fbab23528029108a690e17c533f4c5de405b84159d95ef976bbae3fbead7e

  
Dropping
MD5 61ab599400367ddde8aa493f292a6a6f
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fc1fbab23528029108a690e17c533f4c5de405b84159d95ef976bbae3fbead7e

Comments