MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 235d9ee22fa6f02d8a09a97181fbc64af001b0dde447777e9a2d51aaad104bbb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 235d9ee22fa6f02d8a09a97181fbc64af001b0dde447777e9a2d51aaad104bbb
SHA3-384 hash: 2b8db5d96cad82ca5463a0991f79885ced3eb56c42154801082d2b1271e0352ac150e41105fea01439ff541c0578c981
SHA1 hash: 9336aa0cb937e535c9f5cb223058cc52d350406e
MD5 hash: bcf0f5c4e167fecb1da07e7d0e6fc6f6
humanhash: green-pasta-early-alabama
File name:금일 PO 112935325 3.cab
Download: download sample
Signature Loki
Create hunting rule
File size:227'589 bytes
First seen:2020-08-18 13:15:08 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 3072:yDq6mffUDbOGr1l7qHyC3zBznwD+uieTYU9jKfE6qYyOlrqKoaApPrAkEbAl5Sur:yvz7ihBzFfeMU9jKVqYupTA1AlMusC2k
TLSH 2A2423FCAE1095A9E2E0192660DD5DBFC09BEFD4743B098E2CBF145BD0A75487B81D48
Reporter abuse_ch
Tags:cab geo KOR Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail-smail-vm59.hanmail.net
Sending IP: 203.133.181.18
From: 박주희 <iw3568@daum.net>
Subject: 금일 PO 112935325
Attachment: 금일 PO 112935325 3.cab (contains "PO.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/235d9ee22fa6f02d8a09a97181fbc64af001b0dde447777e9a2d51aaad104bbb/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 13:17:04 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=enoz5yrpu3yc3cqjvfyyd66gjlyadmg54rdxo7u2fvi2vliqjo5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/235d9ee22fa6f02d8a09a97181fbc64af001b0dde447777e9a2d51aaad104bbb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab 235d9ee22fa6f02d8a09a97181fbc64af001b0dde447777e9a2d51aaad104bbb

(this sample)

Loki

Executable exe 8446e0149918e2c9bd8fb1cd060cc1985a206c07ec85dfb6bb6118b631daeb3a

  
Dropping
MD5 92b248e1e9d23915d77126265de2b149
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8446e0149918e2c9bd8fb1cd060cc1985a206c07ec85dfb6bb6118b631daeb3a

Comments