MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d961b05436dd09b85c1a482f398329c9983e1a2c33b4fd820a307a19295c7d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4d961b05436dd09b85c1a482f398329c9983e1a2c33b4fd820a307a19295c7d7
SHA3-384 hash: ac4659c5f632c852ad256cfd671443792581e2cc2c1a2eeed1ff7473546ac0ab6ad1e2d0627ed28b4bca1560b6012870
SHA1 hash: 238be0956899a67d7d55cde7f3297cce1b6bddf7
MD5 hash: 11a9dbefb53ea0b0ca22c35ee96b33a3
humanhash: nuts-oregon-early-delta
File name:발주서송부드립니다.cab
Download: download sample
Signature Loki
Create hunting rule
File size:791'269 bytes
First seen:2020-10-08 13:13:11 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 24576:M52Xy6GJNPqTSA0dOdogQbJjgNpcs4W11i:M5Iy6QNPHfbJE3cjW1A
TLSH 5EF423FD3697368EDB86B2916C3CA21C47BF4144E1076F5A08A78CACDD219C60FB7592
Reporter abuse_ch
Tags:cab geo KOR Loki


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail-smail-vm48.hanmail.net
Sending IP: 203.133.180.236
From: 김승준 <woritec@hanmail.net>
Subject: 발주서송부드립니다.
Attachment: 발주서송부드립니다.cab (contains "PO.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4d961b05436dd09b85c1a482f398329c9983e1a2c33b4fd820a307a19295c7d7/
Threat name:
ByteCode-MSIL.Trojan.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 06:55:36 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jwlbwbkdnxijxbobusbphgbstsmyhyncym5u7wbaumd2deuvy7lq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4d961b05436dd09b85c1a482f398329c9983e1a2c33b4fd820a307a19295c7d7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab 4d961b05436dd09b85c1a482f398329c9983e1a2c33b4fd820a307a19295c7d7

(this sample)

Loki

Executable exe dcbcaf3bd263e87cfa4c5355c0c3236552bef553cd9fd4bec8e57200b71a23a4

  
Dropping
MD5 c69e7e09d13074593fba7966e5769210
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dcbcaf3bd263e87cfa4c5355c0c3236552bef553cd9fd4bec8e57200b71a23a4

Comments