MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d8bda280dbc235288ec12d44dcd30e490949dcbd598cb9314fb341415b2b634. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1d8bda280dbc235288ec12d44dcd30e490949dcbd598cb9314fb341415b2b634
SHA3-384 hash: 7cc7ed2c1c4f93e46ed9d8dc39894eedbeb573438a70c2b90a2b1b3caeca35d184b045a8775a404a060b9ac6f3379703
SHA1 hash: f1fa101a01ab79c1bb04976826e56374a2ca3f5d
MD5 hash: 41af83d4ea20acfe97c09cbd8e13b32b
humanhash: one-winner-five-vegan
File name:KYOCERA.pdf.zip
Download: download sample
Signature Loki
Create hunting rule
File size:466'388 bytes
First seen:2020-10-10 06:41:56 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:k8wmPLaqrP5DjchvCU/mXN+suTvpQMPSiugVeC8/aQTbrPRnvfnJvkGLOKv9SM:kV8aiUz/wN+WM7uQiBfzqE
TLSH 56A423B0F9CF842EDDD1A427560DA7EB8F1C25038572D2B30EE59797E180B5348CA99E
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: holy.herosite.pro
Sending IP: 159.65.99.182
From: Cotecna Co., Ltd <cs@amazingunity.com>
Subject: Price Quote
Attachment: KYOCERA.pdf.zip (contains "KYOCERA.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1d8bda280dbc235288ec12d44dcd30e490949dcbd598cb9314fb341415b2b634/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 09:00:50 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dwf5ukanxqrvfchmclke3tjq4sijjhol2wmmxeyu7m2bifnswy2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1d8bda280dbc235288ec12d44dcd30e490949dcbd598cb9314fb341415b2b634

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 1d8bda280dbc235288ec12d44dcd30e490949dcbd598cb9314fb341415b2b634

(this sample)

Loki

Executable exe c03621f1252606a61ffbccdbf821c68aea9c491df1968a49e21ce74258f0a5f2

  
Dropping
MD5 77d5108a07012b923c11c0310d14c3ca
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c03621f1252606a61ffbccdbf821c68aea9c491df1968a49e21ce74258f0a5f2

Comments