MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07a26f469e222b66894128e4885d2b4e141cc42be76ef30127ca03bb7a62f70f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07a26f469e222b66894128e4885d2b4e141cc42be76ef30127ca03bb7a62f70f
SHA3-384 hash: 8f3ac8df167af0b6158bf01e723c2a8b07534ca4a128e0fd2fcbff4d050557d1f5f9aa66595ed5f8427ba61b3cd0253f
SHA1 hash: 86fa18a5fdc462908abcb9d072dcaad53d28c434
MD5 hash: 4671524f721809efb13cd8a09c39b1be
humanhash: louisiana-purple-nineteen-quebec
File name:bank_swift_pdf.rar
Download: download sample
Signature Loki
Create hunting rule
File size:381'108 bytes
First seen:2021-02-10 06:50:20 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:CURtk9njQ5rUiRFUwfuxu1OskqKBShMlPZQlGV3rAU+A496Wj3c6DBa8B:CUHkyUwCw2xyxCSGxQk3rUnYgc6tb
TLSH 36842322BB97559DA30F07702FC7449DD86DC06FA002A065A5D6F80778D1F8EE1A94FB
Reporter fabjer
Tags:rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/07a26f469e222b66894128e4885d2b4e141cc42be76ef30127ca03bb7a62f70f/
Threat name:
ByteCode-MSIL.Ransomware.TeslaCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-02-10 06:51:07 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a6rg6ru6eivwnckbfdsiqxjljykbzrbl45xpgajhzib3w6tc64hq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/07a26f469e222b66894128e4885d2b4e141cc42be76ef30127ca03bb7a62f70f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 07a26f469e222b66894128e4885d2b4e141cc42be76ef30127ca03bb7a62f70f

(this sample)

Loki

Executable exe 5a20f6f027d90e3efde8d079ab00d86d925f8975d6e8c69e601cf23572eeebeb

  
Dropping
SHA256 5a20f6f027d90e3efde8d079ab00d86d925f8975d6e8c69e601cf23572eeebeb
  
Delivery method
Distributed via e-mail attachment

Comments