MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f4a00aba161a347a0162b10d4f1ef593adf13265d87cf13aba6a53a62070bb9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f4a00aba161a347a0162b10d4f1ef593adf13265d87cf13aba6a53a62070bb9
SHA3-384 hash: 7304af1cf46700f53ffd55f6e83a2a2e00f37ef8ae35ef5196ace266b16cf2031d4b89aba55286d0cac898995c684691
SHA1 hash: 78e66d81348d9de45e32f621b51b34d05ca4fccb
MD5 hash: 1659cc755eaa334772123404b4da48f9
humanhash: skylark-california-summer-finch
File name:Remittance Advice-203948392022019.txt.gz
Download: download sample
Signature Loki
Create hunting rule
File size:586'527 bytes
First seen:2020-10-23 06:36:32 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:mHggYvM8DstLLPYYmOQiM8fjtKgiaxYkhAwsf1Ko86fP60Tv:pgw9YLPYOnMktKgZxHAPreG
TLSH 4EC42342CDE65773C6C9541AD8B0677D34703EF829B4692581E6D2FCC6406BA83BACE3
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: ahenkburomobilya.com
Sending IP: 83.149.106.6
From: Muhasebe Parsa <muhasebe@ahenkburomobilya.com>
Subject: RE: Transfer Copy
Attachment: Remittance Advice-203948392022019.txt.gz (contains "Remittance Advice-#203948392022019.txt.exe")

Loki C2:
http://qataracfridgerepaire.com/wp-admin/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0f4a00aba161a347a0162b10d4f1ef593adf13265d87cf13aba6a53a62070bb9/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 17:16:24 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b5fabk5bmgrupiawfminj4pple5n6ezglwd46e5lu2stuyqhbo4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 0f4a00aba161a347a0162b10d4f1ef593adf13265d87cf13aba6a53a62070bb9

(this sample)

Loki

Executable exe 0bd5d64782a5e667b4bdff972591924d34e653e636c2f9c21b14e844c3cf9b74

  
Dropping
MD5 c5a74ca7935a6ff53be6c4d17fffabbd
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0bd5d64782a5e667b4bdff972591924d34e653e636c2f9c21b14e844c3cf9b74

Comments