MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ea27c1e47b0e4bd55b1f58b21b98fa0d09a978a8bc2b05266f10e988a5284dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ea27c1e47b0e4bd55b1f58b21b98fa0d09a978a8bc2b05266f10e988a5284dc
SHA3-384 hash: 084989dce95c4dd8e84b94d63790adb45dcacec5f3cbfd1686474e11295d21c0d293b226f08b19de77b466eac7db5591
SHA1 hash: 444ee168fec9fbef292a91fd28ae8a26d10ffdb6
MD5 hash: 579fbcd2d1215eefea2a6f598e66ac48
humanhash: equal-crazy-yankee-maine
File name:Payment Copy_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:153'493 bytes
First seen:2021-02-08 09:05:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:vKIqdz+eX9tRWPJs9cv0BFA/6DeaQ9Icp/g2jj+wnWAqGkzOdHB:SfhXzRWPJEhDJeaQ9IK4jPjOdHB
TLSH 63E31242F599573BBF80706AC597FB6CE9C7688EB6232C249C3472BB48224BF451905D
Reporter cocaman
Tags:gz


Avatar
cocaman
Malicious email (T1566.001)
From: ""Purchase" <purchase@opsmarinetime.com>" (likely spoofed)
Received: "from opsmarinetime.com (maildc1519218099.mihandns.com [188.212.22.220]) "
Date: "Mon, 08 Feb 2021 02:33:21 -0500 (EST)"
Subject: "Payment Advice For Overdue Invoice"
Attachment: "Payment Copy_pdf.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_badexts14.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2ea27c1e47b0e4bd55b1f58b21b98fa0d09a978a8bc2b05266f10e988a5284dc/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-08 08:00:06 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f2rhyhshwdsl2vnr6wfsdompudijvf4krpblautg6ehjrcssqtoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2ea27c1e47b0e4bd55b1f58b21b98fa0d09a978a8bc2b05266f10e988a5284dc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 2ea27c1e47b0e4bd55b1f58b21b98fa0d09a978a8bc2b05266f10e988a5284dc

(this sample)

Loki

Executable exe cffc78e64ca2533de6c216b9420fde1e51884ac2b82e340a400466ed96002017

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cffc78e64ca2533de6c216b9420fde1e51884ac2b82e340a400466ed96002017

Comments