MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4006f609be9a73ca893b01f4c397152b06b3d5e4a39a34698dee628487e0a632. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4006f609be9a73ca893b01f4c397152b06b3d5e4a39a34698dee628487e0a632
SHA3-384 hash: 70040b45280e0f69827dac4db04fb4173aefbe259a3fcb08db5cf56e156a970b3f76bd5db880136b8aad463f85bbef24
SHA1 hash: 802ca86c4b7de299313b27877fff0864e6dedbf0
MD5 hash: d7d85b73667acc6bfa122d705f98058e
humanhash: ceiling-crazy-timing-lamp
File name:SOA28012021_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:623'231 bytes
First seen:2021-01-28 15:47:38 UTC
Last seen:2021-02-17 20:59:39 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:BfPSxN64qq7jO3tP1pc+FNgvdW1zNSt2Esezf+uE1f:xPYzC8+3yM1ZvEA1f
TLSH 83D433513DD9ECA4B1CA83EFC2C1DF78A06A5F4A0252A6287AAE7D0D9F735CE045C711
Reporter GovCERT_CH

Intelligence

File Origin
# of uploads :
31
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4006f609be9a73ca893b01f4c397152b06b3d5e4a39a34698dee628487e0a632/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-28 15:48:06 UTC
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iadpmcn6tjz4vcj3ah2mhfyvfmdlhvpeuondi2mn5zrijb7auyza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4006f609be9a73ca893b01f4c397152b06b3d5e4a39a34698dee628487e0a632

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 4006f609be9a73ca893b01f4c397152b06b3d5e4a39a34698dee628487e0a632

(this sample)

Loki

Executable exe 41d6d55849c6b5fc16d491d5e6ef98337ff18fc90e8146a186d8dabc2303d361

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 41d6d55849c6b5fc16d491d5e6ef98337ff18fc90e8146a186d8dabc2303d361
  
Dropping
MD5 f07fee9be7ff8c8f04d657751b48e020

Comments