MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd65024a0f6789d5e29bef36fa26c43204728d7c81576ba4a6d2b9e2d19f2eee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd65024a0f6789d5e29bef36fa26c43204728d7c81576ba4a6d2b9e2d19f2eee
SHA3-384 hash: 364357551e54b6570f9db3cb7893ca040cab2d8bd0ef4d6589a48064f1b4e02848c294be217a6d5811f709309ac83982
SHA1 hash: 0b92e10f691f6fc29c1ba636d6606bbe3469a605
MD5 hash: 0225d55bf8a683d54cbbadb984d09cf6
humanhash: two-mike-north-october
File name:MV YANGZE - Cash calculation.cab
Download: download sample
Signature Loki
Create hunting rule
File size:316'099 bytes
First seen:2020-08-18 19:33:57 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:+sKDqBR10rP/sBPKaLuWy04/9bjREIIB17x+iihe6eqj+A:+FuBPOW1o04JFpId+iDA
TLSH EA642329588F600EE01F6779B401E72CBDA04842C6603035AFDBDEEA135BD79D4F999D
Reporter abuse_ch
Tags:cab Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: swn0.708.zazomika.ml
Sending IP: 68.183.64.100
From: "grg@sinoship.cn" <gpg@sinoship.cn>
Subject: MV YANGZE 17--CTM APPLICATION @SHIPYARD
Attachment: MV YANGZE - Cash calculation.cab (contains "MV YANGZE - Cash calculation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd65024a0f6789d5e29bef36fa26c43204728d7c81576ba4a6d2b9e2d19f2eee/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 03:22:08 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7vsqesqpm6e5lyu3543pujwegichfdl4qflwxjfg2k46fum7f3xa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fd65024a0f6789d5e29bef36fa26c43204728d7c81576ba4a6d2b9e2d19f2eee

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab fd65024a0f6789d5e29bef36fa26c43204728d7c81576ba4a6d2b9e2d19f2eee

(this sample)

Loki

Executable exe fa3477d198b6985927704a44c1eb10fada6e2a604d62bf9a56636de415b32d1f

  
Dropping
MD5 a191af6afeba7e39e328037aed74025f
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fa3477d198b6985927704a44c1eb10fada6e2a604d62bf9a56636de415b32d1f

Comments