MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f02eba653c0671484572945dd6ec16ad1999fe133efd15cf6ffbd4dc66da570. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f02eba653c0671484572945dd6ec16ad1999fe133efd15cf6ffbd4dc66da570
SHA3-384 hash: bec00b2ecc8a53ab3155d9ce5491261caecad17047eb030da8b3b7db5c2a967d09b6dfa069783ad7dcabda0826817459
SHA1 hash: 7738de1d971c68b4c946599b73b8356801a717c2
MD5 hash: 2b4912ee9728a1c1f0d076bf9741a498
humanhash: pizza-oregon-island-may
File name:2b4912ee9728a1c1f0d076bf9741a498.exe
Download: download sample
Signature Loki
Create hunting rule
File size:330'540 bytes
First seen:2020-06-28 06:59:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c2c71dfce9a27650634dc8b1ca03bf0 (160 x Loki, 58 x Formbook, 55 x Adware.Generic)
ssdeep 6144:zPCganNluOz2eqHr5c9LAn36+Cqwaagq/w0dCMn2QHb96gNL5Qi:hanfj2dsAnkqwrNBdCyVNV
TLSH 02641262A3A2D8F7E2D203304EFF5E292AD1DD0B25817957DBD02E1FBD061829E5C253
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://b2bseller.ga/chang/gate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/15146/
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

SecuriteInfo.com.Artemis162931E90DCF.4593.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Launching a process
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f02eba653c0671484572945dd6ec16ad1999fe133efd15cf6ffbd4dc66da570/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-24 18:44:00 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d4boxjstybtrjbcxffc523wbnlizth7bgpx5cxhw766u3rtnuvya._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200628-xgdpfpqsh2/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: GetForegroundWindowSpam
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15146/

Comments