MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4459831397e3ba44554b2dec62a53a65781ba03301bff9102ee2303db293e1b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4459831397e3ba44554b2dec62a53a65781ba03301bff9102ee2303db293e1b0
SHA3-384 hash: a756021d89083df5df3430907dfe72ab3b121111c2c83e463659932566efa1df8ef28199687f1afafcd332d04277afba
SHA1 hash: 37c34d7428235f0fe8bb1f29b3287a4b22d13770
MD5 hash: ea7b56cfcaa04f108090caa7523ffc74
humanhash: april-five-oregon-pluto
File name:RFQ1dNv8HlLMnXf.UUE
Download: download sample
Signature Loki
Create hunting rule
File size:431'107 bytes
First seen:2022-07-22 06:36:06 UTC
Last seen:2022-07-22 11:50:19 UTC
File type: uue
MIME type:application/x-rar
ssdeep 12288:zvVxUlPwgMvqrph3dSCy4xPDWw7DB1hpU11A:zv/UlPwgMvqNhNSCZxrWk7h21A
TLSH T157942396E4E61041BD83037768A34602A6A37F488B36C1FACD6745218F7C5CBEEE46F5
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:Loki QUOTATION RFQ uue


Avatar
cocaman
Malicious email (T1566.001)
From: "George Tassis <gtassis@ilkat.gr>" (likely spoofed)
Received: "from ilkat.gr (unknown [45.137.22.101]) "
Date: "21 Jul 2022 18:19:48 +0200"
Subject: "Request for Quotation - Urgent"
Attachment: "RFQ1dNv8HlLMnXf.UUE"

Intelligence

File Origin
# of uploads :
2
# of downloads :
211
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4459831397e3ba44554b2dec62a53a65781ba03301bff9102ee2303db293e1b0/
Threat name:
ByteCode-MSIL.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2022-07-21 12:35:46 UTC
File Type:
Binary (Archive)
Extracted files:
24
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=irmyge4x4o5eivklfxwgfjj2mv4bxibtag77sebo4iyd3mut4gya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4459831397e3ba44554b2dec62a53a65781ba03301bff9102ee2303db293e1b0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

uue 4459831397e3ba44554b2dec62a53a65781ba03301bff9102ee2303db293e1b0

(this sample)

Loki

Executable exe 52b18494008811d0277d2a3397df855d80a9575c09e11225950fd9f505850346

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 52b18494008811d0277d2a3397df855d80a9575c09e11225950fd9f505850346
  
Dropping
Loki

Comments