MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5b31850b1d688903053ad3f3e40c99cbd131c06d42653e696241e14f6ea25d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5b31850b1d688903053ad3f3e40c99cbd131c06d42653e696241e14f6ea25d5
SHA3-384 hash: a6b8dfeef464ffa3e0e4c56e31846de655ef828b550c05e88c5427721a0d14fb44c76a9f419570bc4962472779a2110f
SHA1 hash: 6b7ac91255de5945179d43aa85e35a9da390986f
MD5 hash: 27a55624277c1f8abd2bbeea23882818
humanhash: fruit-ten-whiskey-glucose
File name:Part payment slip and revised invoice.cab
Download: download sample
Signature Loki
Create hunting rule
File size:392'156 bytes
First seen:2020-08-31 11:04:03 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:iIGH1D8wNz4f7PEeo/8opqowBi7KDvrWCnoAUNt/5mWcMFXhbkzree5grUpoqIv:sH1PVhnGrrgRzBmQwzx5G9
TLSH 898423206EB17B2A597F82E4B44511E1EC2ACEC617DF3825AD935FA0C704B3D6C1C6B9
Reporter abuse_ch
Tags:cab Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: ew0.712.maxzizo.ml
Sending IP: 143.110.136.83
From: Mr. X <shao.y@sinoma-wbmdi.cn>
Reply-To: shao.y@sinoma-wbmdi.cn
Subject: IMPORTANT: BULK PAYMENT IN SPLITS DONE FOR PURCHASE ORDER 37FG43RWE2
Attachment: Part payment slip and revised invoice.cab (contains "Part payment slip and revised invoice.exe")

Loki C2:
http://duclongetc.com/a/need/work/Panel/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.Trojan-7.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d5b31850b1d688903053ad3f3e40c99cbd131c06d42653e696241e14f6ea25d5/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 04:51:15 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2wzrqufr22ejamctvu7t4qgjts6rghag2qtfhzuweqpbj5xkexkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d5b31850b1d688903053ad3f3e40c99cbd131c06d42653e696241e14f6ea25d5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab d5b31850b1d688903053ad3f3e40c99cbd131c06d42653e696241e14f6ea25d5

(this sample)

Loki

Executable exe 67831ccdbeefd8c7e6263be850afd59b2ecfe8482ce4977514e75ecfefd49a9f

  
Dropping
MD5 fa68f290fb24879e4e6cf73492cf5cb0
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 67831ccdbeefd8c7e6263be850afd59b2ecfe8482ce4977514e75ecfefd49a9f

Comments