MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52ca139b5b6cc6e7f41f4aadd1da800e5b30479f07eaca8347743cf2054cac6b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52ca139b5b6cc6e7f41f4aadd1da800e5b30479f07eaca8347743cf2054cac6b
SHA3-384 hash: 76a000aa1ea4af103e7820bc6ddfdd64a9f9899725c0c876ccff3e406e29364bfbebc21fd07381aafb45f26b26e6dcdd
SHA1 hash: a523f19e1f1552fe55a42f59ba42c6d44220303b
MD5 hash: e0c755fa05dd8e6307afb7188661bbd9
humanhash: apart-michigan-blossom-kitten
File name:PO-099-13-21, dat du 01.13.2021.r13
Download: download sample
Signature Loki
Create hunting rule
File size:489'894 bytes
First seen:2021-01-13 20:11:23 UTC
Last seen:2021-01-14 08:29:19 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:sl4TFq6OGvp+CgMaiUOWrjJ+DhYg9MQ1FjRaW:Nq2evtr0Dbl19RaW
TLSH FBA423A9DDD80EC827FD8C9AAADCCCD72E1ECC2D086C05D68B0457D66DDEBA1B1B1051
Reporter abuse_ch
Tags:Loki r13


Avatar
abuse_ch
Malspam distributing Loki:

HELO: zephir.ph
Sending IP: 45.137.22.41
From: Valérie ALONSO <info@zephir.ph>
Subject: Re:reconnaissance de P.O
Attachment: PO-099-13-21, dat du 01.13.2021.r13 (contains "PO-099-13-21, dat")

Intelligence

File Origin
# of uploads :
2
# of downloads :
172
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/52ca139b5b6cc6e7f41f4aadd1da800e5b30479f07eaca8347743cf2054cac6b/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-01-13 20:12:11 UTC
AV detection:
14 of 46 (30.43%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=klfbhg23ntdop5a7jkw5dwuabzntar47a7vmva2hoq6pebkmvrvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/52ca139b5b6cc6e7f41f4aadd1da800e5b30479f07eaca8347743cf2054cac6b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 52ca139b5b6cc6e7f41f4aadd1da800e5b30479f07eaca8347743cf2054cac6b

(this sample)

Loki

Executable exe 3ea4d93621845dc92c1d107b744cc193376978b230782bfc87bf3b9a985e5218

  
Dropping
MD5 f590fca19aa4eaa3d59a2ed6f2c85c43
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3ea4d93621845dc92c1d107b744cc193376978b230782bfc87bf3b9a985e5218

Comments