MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 521c45720cabfd1e694b66249f650728a3fb08d72c6583705718e663a970cdd6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 521c45720cabfd1e694b66249f650728a3fb08d72c6583705718e663a970cdd6
SHA3-384 hash: d9b1c2afb9f5677261e2592de812230f0ce1f4a19be488f2a11f67c516573cedf3e2938517716b385f65e61462029701
SHA1 hash: e6561fb73f6b85184df112abfa0846245c8433e8
MD5 hash: 857c70d21ac754c4456407ae53813782
humanhash: eleven-quebec-eleven-arizona
File name:Enq2381813839.pdf.arj
Download: download sample
Signature Loki
Create hunting rule
File size:516'170 bytes
First seen:2020-12-17 08:33:39 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:v16GKtdrUP6h25m8cTWRLr+d6k0qUnw+QifL7jg:EGKtdrUi25m+wKl/Dw
TLSH C5B4239FA258FC619CC509D12A4B95286761FDCBD095F6C76833A72F0C3C342D4EE8A5
Reporter abuse_ch
Tags:arj Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: host.cmxbd.com
Sending IP: 204.197.252.164
From: Captain Sergiy Kuzmenko <master@libertyisland.pacificbasin.com>
Reply-To: master@libertyisland.pacificbasin.com
Subject: Enquiry: MV Liberty Island, E2381813839
Attachment: Enq2381813839.pdf.arj (contains "Enq2381813839_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/521c45720cabfd1e694b66249f650728a3fb08d72c6583705718e663a970cdd6/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-12-17 08:34:15 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kioek4qmvp6r42klmysj6zihfcr7wcgxfrsyg4cxddtghklqzxla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/521c45720cabfd1e694b66249f650728a3fb08d72c6583705718e663a970cdd6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

arj 521c45720cabfd1e694b66249f650728a3fb08d72c6583705718e663a970cdd6

(this sample)

Loki

Executable exe dc399555ad04ca7d8a61dbe8ec3804eba97c46aa30f785a83d68f961bc364032

  
Dropping
MD5 992ddde4d6d3d6eed7259953e1a6e477
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dc399555ad04ca7d8a61dbe8ec3804eba97c46aa30f785a83d68f961bc364032

Comments