MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a3f935ae45f99a0a44420396964f3056005a4b506ca191304b86a4d4d2f8b9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a3f935ae45f99a0a44420396964f3056005a4b506ca191304b86a4d4d2f8b9e
SHA3-384 hash: 04b6c6c1076e0f59dd1145aaec5fbd5c92c30ce727629d80e75611ffee3046ec1e4bc895922a446dcc8fe8dd28f71537
SHA1 hash: d29a6e7792ab1992741ee7d8863df8130a15d08c
MD5 hash: 75f43e64eb93344c84ea999779dd643b
humanhash: cup-alanine-potato-vermont
File name:Magda Order List_pdf.rar
Download: download sample
Signature Loki
Create hunting rule
File size:271'494 bytes
First seen:2020-08-06 06:54:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:GTwyhkFL6hMrw6WY86g1FhrI77VLkjx8hmbzZHQf:M5Gm4wgWFhrI77Vgjx8hY1U
TLSH E44423F10465EE186986D33464DF8726449F4C163A6F9869528EBAFDD70F02EF0A2F07
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.genogan.ga
Sending IP: 45.147.162.107
From: Magda Carlabimmo <admin@genogan.ga>
Subject: Re: Order Inquiry Magda Carlabimmo
Attachment: Magda Order List_pdf.rar (contains "Magda Order List_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5a3f935ae45f99a0a44420396964f3056005a4b506ca191304b86a4d4d2f8b9e/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 06:56:09 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=li7zgwxel6m2bjceea4wszhtavqaljfva3fbseyexbve2tjpropa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5a3f935ae45f99a0a44420396964f3056005a4b506ca191304b86a4d4d2f8b9e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 5a3f935ae45f99a0a44420396964f3056005a4b506ca191304b86a4d4d2f8b9e

(this sample)

Loki

Executable exe d1a5575165e8b38282aea76864b4e01f906ee5177d2376c8a6a4fa4d4fd520fe

  
Dropping
MD5 f6d6551c958088333fe741d6501ff0e8
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d1a5575165e8b38282aea76864b4e01f906ee5177d2376c8a6a4fa4d4fd520fe

Comments