MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93ab292cae7b58949cfdbb7d996e45ed6f1c57c1e7813cbf9d864c12a11202b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93ab292cae7b58949cfdbb7d996e45ed6f1c57c1e7813cbf9d864c12a11202b8
SHA3-384 hash: 5f26b87e312810d903129a47c860d81656ab07dd93c3fa1c651cb4e75252059008bf408e2ba421115016aace89e9b2f4
SHA1 hash: dfcb46236b9f9d18f2c0003ce549f1459d690f64
MD5 hash: 34676b87d965fa2445d6f401dd17fe81
humanhash: ceiling-wisconsin-ack-four
File name:TR4250MbnSC3ZX -pdf.arj
Download: download sample
Signature Loki
Create hunting rule
File size:315'783 bytes
First seen:2020-08-10 09:57:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:fgK5jy71Q6uAXb49W0UhY/cJ4lzylxb1s:P5jy71QeX89/UhQu4lzOxb1s
TLSH C86423A8627EF7593FA8CE4715AE870C3DD511F8913BCD2A540C3590A6BE944E43F68C
Reporter abuse_ch
Tags:arj Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: gl-uniexco.com
Sending IP: 103.141.138.118
From: Mercè Sanabra <m.sanabar@gl-uniexco.com>
Reply-To: Mercè Sanabra <m.sanabar@gl-uniexco.com>
Subject: RE: LCL SEAFREIGHT SHPMT QUOTATION C/ RFQ LCL
Attachment: TR4250MbnSC3ZX -pdf.arj (contains "TR4250MbnSC3ZX -pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25906.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/93ab292cae7b58949cfdbb7d996e45ed6f1c57c1e7813cbf9d864c12a11202b8/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 09:59:05 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sovsslfopnmjjhh5xn6zs3sf5vxryv6b46atzp45qzgbfiisak4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/93ab292cae7b58949cfdbb7d996e45ed6f1c57c1e7813cbf9d864c12a11202b8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 93ab292cae7b58949cfdbb7d996e45ed6f1c57c1e7813cbf9d864c12a11202b8

(this sample)

Loki

Executable exe fdbf6a04cf22bfdc28694cc9b1b0e425abfbe97433cfc3cf5ee4a655a56e2b92

  
Dropping
MD5 fe9165b0b3a81e86ddc23cd632b20a45
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fdbf6a04cf22bfdc28694cc9b1b0e425abfbe97433cfc3cf5ee4a655a56e2b92

Comments