MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4dcd86713914220d867fdffd6228c5f4347404277e59b5b45648b3ed3a1bf089. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4dcd86713914220d867fdffd6228c5f4347404277e59b5b45648b3ed3a1bf089
SHA3-384 hash: 3ba3b465ebcb08d16ad32e4b74640a40b1d5291c06ba13f54e85a2de7ec912ac12a0f7927be6a344514af02929962b9b
SHA1 hash: efc986b9914212b11d01d38b727953be01528a26
MD5 hash: dba9e657c15b02a30bd079ba2467f958
humanhash: lake-nuts-finch-blue
File name:file.cab
Download: download sample
Signature Loki
Create hunting rule
File size:139'773 bytes
First seen:2020-07-13 06:34:38 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 3072:QEjrhldQ3/yfc4SFbLqlIsDuZruMRlmKcYQEoRJFtL7:Qss/yfcbLqlIsDy7RlAYQXJFt
TLSH EAD3126FAA0C3FDB97686824812F9FD5618ED8C67504F7D0643E79DD888C9052211BBF
Reporter abuse_ch
Tags:cab geo KOR Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail-smail-vm85.hanmail.net
Sending IP: 211.231.106.160
From: 비 엘 두 주 식 회 사 <gnlrud1206@daum.net>
Subject: 견적용입니다 긴급으로 견적만 주세요
Attachment: file.cab (contains "whitty.exe")

Loki C2:
http://79.124.8.8/plesk-site-preview/akinsab.ru/http/79.124.8.8/whitty/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4dcd86713914220d867fdffd6228c5f4347404277e59b5b45648b3ed3a1bf089/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 06:36:06 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jxgym4jzcqra3bt7376wekgf6q2hibbhpzm3lncwjcz62oq36ceq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab 4dcd86713914220d867fdffd6228c5f4347404277e59b5b45648b3ed3a1bf089

(this sample)

Loki

Executable exe 57e052aa747095c82cdc7e459d734e98bf1dde6853d94f2b1179f47b30ddcdad

  
Dropping
MD5 2e107acd5b8ed0e66c5fee0513ace7c1
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 57e052aa747095c82cdc7e459d734e98bf1dde6853d94f2b1179f47b30ddcdad

Comments