MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1dce260ae8abe296f472eb76bdae463df5400a9a561025a72e99d5026724ab82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loda


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1dce260ae8abe296f472eb76bdae463df5400a9a561025a72e99d5026724ab82
SHA3-384 hash: 044a32126f17dfd74d71aeaf6dbdfeedee54881c0ba89aa826010bfb8c9f6a43405caba3fc528848d758518019322099
SHA1 hash: 62952a125afa63e7bfe92e6adf887ac325e49ba8
MD5 hash: fac9631769543ee78a88aed9a60ab9a0
humanhash: six-kitten-triple-artist
File name:Order_Payment.rar
Download: download sample
Signature Loda
Create hunting rule
File size:1'311'989 bytes
First seen:2020-05-05 11:38:48 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:MsC4xsqIB/Xv+rGrXaPwiyPHG2yCBhG6sL8Er5K3sR2Q8zmVTExsT:MsC4x8B/Xv+CX1igxCLjVK3+CxsT
TLSH 585533DC11ABC53E9D7C0318A8FBF8ECD61F58386545ED379C106672C89683622BA6D3
Reporter abuse_ch
Tags:Loda rar


Avatar
abuse_ch
Malspam distributing Loda:

HELO: slot0.globalpumps-com.ga
Sending IP: 64.52.84.4
From: Global PUMPS LTD <info@globalpumps-com.ga>
Reply-To: Global PUMPS LTD <airwestm@unamaf-undp.org>
Subject: Re: Order
Attachment: Order_Payment.rar (contains "Order_Payment.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 12:36:11 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
15 of 30 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dxhcmcxivprjn5ds5n3l3lsghx2uacu2kyicljzothkqezzevoba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loda

rar 1dce260ae8abe296f472eb76bdae463df5400a9a561025a72e99d5026724ab82

(this sample)

Loda

Executable exe 215efb4d72a987d380f71ce2cea15cb73c3084253026a2c80efd7a3c83ae5f9f

  
Dropping
MD5 a63b5bcdaf023f3a7b98af1b7ec5b7fb
  
Dropping
Loda
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 215efb4d72a987d380f71ce2cea15cb73c3084253026a2c80efd7a3c83ae5f9f

Comments