MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7330fa1eb0cb192e7a082ee074ca0445b74956bb982099682110e6ce8da85fe8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7330fa1eb0cb192e7a082ee074ca0445b74956bb982099682110e6ce8da85fe8
SHA3-384 hash: 33b67e0c16aa10393701c4ce65562395d67e04220a60e031c18a1b325a9835886fc1d72a253640206b9af730b88aa6de
SHA1 hash: 4f8f1d846e17e0f68fddc86ae4cf5b242239d5ef
MD5 hash: 4f2f320d1697d06700d33041f67376f1
humanhash: venus-fifteen-harry-minnesota
File name:8883_774_pdf.zip
Download: download sample
Signature Loki
Create hunting rule
File size:358'400 bytes
First seen:2020-07-29 06:20:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:NB7oHLuAH8MTPXw3ty3xzY646lWJ/Wk4Hnom6Oihn5Vfnn9Ja1qF8jNNrUH0:rEHiAH8KPA34BzY6Pg1VpXfnn9Ja8ezN
TLSH 6F7423892949006BDC5CB763AA5FFEB709A96C2B4FC70CFC47A6C44F12105BCB921365
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: pkz37-4-spamexpert2.hoster.kz
Sending IP: 185.113.132.23
From: zpk_nii@rniiot.kz
Subject: AUTOMATED PAYMENT CONFIRMATION(USD198,000.00)
Attachment: 8883_774_pdf.zip (contains "8883_774_pdf.exe")

Loki C2:
http://beckhoff-th.com/kon/kon1/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7330fa1eb0cb192e7a082ee074ca0445b74956bb982099682110e6ce8da85fe8/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 06:22:07 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=omypuhvqzmms46qif3qhjsqeiw3usvv3taqjs2bbcdtm5dnil7ua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/7330fa1eb0cb192e7a082ee074ca0445b74956bb982099682110e6ce8da85fe8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 7330fa1eb0cb192e7a082ee074ca0445b74956bb982099682110e6ce8da85fe8

(this sample)

Loki

Executable exe a83d00913bb5e3f6e95d31626388d67c0db45fbd098d68e63e88c0167f248620

  
Dropping
MD5 4f0f049d514c094a0a56f1ff91c57e4b
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a83d00913bb5e3f6e95d31626388d67c0db45fbd098d68e63e88c0167f248620

Comments