MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27e426730819d8ada831a9678da3aece524b0a2d59925d8a4b3aa17328c2d6d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 27e426730819d8ada831a9678da3aece524b0a2d59925d8a4b3aa17328c2d6d2
SHA3-384 hash: 4b7e8a6ebaaab2548749a2ff23462fd17722ca4ea2dd4bc046a6f2aa1e1c02cdba3ee48b484136e1784cedeb1475fc1e
SHA1 hash: fa3e3d1df3625b4d9ce11aeca038be8c4e3aff63
MD5 hash: b3f3a1d734f5f087ef95b222db9b2cc9
humanhash: west-bluebird-carpet-fourteen
File name:purchase_order_PO014328.xz__.rar
Download: download sample
Signature Loki
Create hunting rule
File size:363'249 bytes
First seen:2021-03-16 10:22:08 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:+rBEVdEGt4Y1X2bUo74jEZOyqdGFdaxMI1qKqb/nYM4GOIfVD5xzawbRbZ+atK:+rigGtzR2Qo8Q1OxSKYYuVDHzawFbZ+L
TLSH F2742365D58540DD4446B5470ACAC708C29BABB4CCB3F7A7E46B645F420BCCBD0BEBA2
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail0.jauindustry.org
Sending IP: 142.93.103.69
From: Tamizharasan .p <exports@jauindustry.org>
Subject: purchase order PO014328
Attachment: purchase_order_PO014328.xz__.rar (contains "purchase order PO014328.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/27e426730819d8ada831a9678da3aece524b0a2d59925d8a4b3aa17328c2d6d2/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-03-16 10:23:05 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e7scm4yidhmk3kbrvfty3i5ozzjewcrnlgjf3cslhkqxgkgc23ja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/27e426730819d8ada831a9678da3aece524b0a2d59925d8a4b3aa17328c2d6d2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 27e426730819d8ada831a9678da3aece524b0a2d59925d8a4b3aa17328c2d6d2

(this sample)

Loki

Executable exe e7f7bafee06c31b93f5f813d4170108f5d4c1ced17eab3e6ca5a70efe2fdb570

  
Dropping
MD5 8405e764f0a78b945946fa247657086d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e7f7bafee06c31b93f5f813d4170108f5d4c1ced17eab3e6ca5a70efe2fdb570

Comments