MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5310168cefa0c3f4b0ea699166848a270dbd54868555be244c905c702992e832. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5310168cefa0c3f4b0ea699166848a270dbd54868555be244c905c702992e832
SHA3-384 hash: 055d27f04cc06b1893b073f53ebe3ea10921e0a0480f83e028b1ad8cf87da6f2c9af3e6251717888aa1a445ff93e5965
SHA1 hash: ea0b17062be986cd9b71bb88c300d8b0cd458d91
MD5 hash: 39e53255a381a9e7539539c621ff9dd7
humanhash: october-victor-cola-monkey
File name:YOUNG SHIN TEXTILE CO.,LTD..cab
Download: download sample
Signature Loki
Create hunting rule
File size:350'046 bytes
First seen:2020-08-27 08:04:08 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:rhvjK5i3pjWkEEBG9zlT5LhVz7wBcgsjzXo+xun79mUqnRnVacFEnPgwuwC4jz:rhvsblEBqdLPOcdxu79vWR1FUgwuwxf
TLSH FA7423C50125F2DE3EA6D67BAC0B9B87400CDD350EEAF2674DC452F46EE4866EB460B4
Reporter abuse_ch
Tags:cab Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail-smail-vm41.hanmail.net
Sending IP: 203.133.180.229
From: YOUNG SHIN TEXTILE CO.,LTD. <kldi2018@daum.net>
Subject: YOUNG SHIN TEXTILE CO.,LTD.
Attachment: YOUNG SHIN TEXTILE CO.,LTD..cab (contains "YOUNG SHIN TEXTILE CO.,LTD..exe")

Loki C2:
http://79.124.8.8/plesk-site-preview/benetaeu-group.com/http/79.124.8.8/goodluck/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5310168cefa0c3f4b0ea699166848a270dbd54868555be244c905c702992e832/
Threat name:
Win32.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-08-27 08:06:06 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kmibndhpudb7jmhkngiwnbeke4g32vegqvk34jcmsbohakms5aza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/5310168cefa0c3f4b0ea699166848a270dbd54868555be244c905c702992e832

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab 5310168cefa0c3f4b0ea699166848a270dbd54868555be244c905c702992e832

(this sample)

Loki

Executable exe 98d4b7190b6a816819aa380c586680a0b5129d9516d51a2eed25f6399c93b23a

  
Dropping
MD5 5d731f95d12274a98593fe347143f4f4
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 98d4b7190b6a816819aa380c586680a0b5129d9516d51a2eed25f6399c93b23a

Comments