MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e748da7f030138027f9b0cfacd1e9878b05a59c0cfd2501a59297cbdfac9e4b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e748da7f030138027f9b0cfacd1e9878b05a59c0cfd2501a59297cbdfac9e4b
SHA3-384 hash: a1238a42b1912d951b5532d0f0a9291b55ef58492fd73451e4376d984d6e99070161d3e4b01809be0985adba9560dd8c
SHA1 hash: 62796e9c727827c8cc8b84edfa245fd91a9e512a
MD5 hash: b6741ae404a89864733ab3bda8f93868
humanhash: fifteen-potato-illinois-sodium
File name:PO.cab
Download: download sample
Signature Loki
Create hunting rule
File size:497'053 bytes
First seen:2020-10-06 06:01:06 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:t1D0WPmj+Ik0caUfSRyt7v4ecoxSbluuy5I9RddhOAU:jAgMTh27vvkYV2dDa
TLSH 02B423B27B7AD97CD4BD9CF1AC3EE2810240DEB4B3A0B2971A53889C93565019E7439D
Reporter abuse_ch
Tags:cab geo KOR Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail-smail-vm47.hanmail.net
Sending IP: 203.133.180.235
From: 발신자 이규철 <hanlalm@hanmail.net>
Subject: 하위 견적
Attachment: PO.cab (contains "PO.exe")

Loki C2:
http://79.124.8.8/plesk-site-preview/coautomaquinaria.com/http/79.124.8.8/wonjure/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4e748da7f030138027f9b0cfacd1e9878b05a59c0cfd2501a59297cbdfac9e4b/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 01:56:33 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jz2i3j7qgajyaj7zwdh2zupjq6fqljm4bt6skanfskl4xx5mtzfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/4e748da7f030138027f9b0cfacd1e9878b05a59c0cfd2501a59297cbdfac9e4b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab 4e748da7f030138027f9b0cfacd1e9878b05a59c0cfd2501a59297cbdfac9e4b

(this sample)

Loki

Executable exe bd83b7f557dc2b2b74d0b8c9891628468644a9ad2e85edb93ad05823172878f2

  
Dropping
MD5 95d110fad2705ef977cb147c58b80a80
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bd83b7f557dc2b2b74d0b8c9891628468644a9ad2e85edb93ad05823172878f2

Comments