MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51a128d9eff6154b67abdd15737e419639b76b182f68019204e98fb830fe6d32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51a128d9eff6154b67abdd15737e419639b76b182f68019204e98fb830fe6d32
SHA3-384 hash: a2cb916f097ae820c373e42176a55ecd1f2cac8f840b2e23e3737a05dc6be3c1ba6ab92d00890dfe656b421071408e02
SHA1 hash: 6a2f856f24a9bee6af8ce4ed0fb49bb9f85d03fb
MD5 hash: 23363e8453f40781294671032c53f491
humanhash: fish-thirteen-cold-football
File name:WaybillDoc_1972493692.pdf.ace
Download: download sample
Signature Loki
Create hunting rule
File size:920'977 bytes
First seen:2021-03-08 09:44:39 UTC
Last seen:2021-03-10 21:51:41 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 24576:Ybxp+ljOM7z9DoS0hElm/1I+yZtg7vvLwJE9uW4TWS/HK8iLaTu:+xcljJ+2l6+O7nMJjTWOKF
TLSH DC15339FA33F9250D9D4E9952287B32EC4C46FE4476CADC848085DC7704EB2A705EA6F
Reporter GovCERT_CH
Tags:Loki

Intelligence

File Origin
# of uploads :
8
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/51a128d9eff6154b67abdd15737e419639b76b182f68019204e98fb830fe6d32/
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2021-03-08 09:45:10 UTC
AV detection:
15 of 25 (60.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kgqsrwpp6ykuwz5l3ukxg7sbsy43o2yyf5uadeqe5gh3qmh6nuza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/51a128d9eff6154b67abdd15737e419639b76b182f68019204e98fb830fe6d32

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

ace 51a128d9eff6154b67abdd15737e419639b76b182f68019204e98fb830fe6d32

(this sample)

Loki

Executable exe 97b68c9bf689232d9ba457a3f39ff815400e9ed0adf6dfadca5809784c205cfb

  
Dropped by
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 97b68c9bf689232d9ba457a3f39ff815400e9ed0adf6dfadca5809784c205cfb
  
Dropping
MD5 3f51ac12507c4c4b5bf3a7e5619f7485

Comments