MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58bf6897e24f6b2e192e241466031b88193f066a9a3d7da15e068d80defedb26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58bf6897e24f6b2e192e241466031b88193f066a9a3d7da15e068d80defedb26
SHA3-384 hash: 4d3611c5f2cb3759ebbea30e4a4db6e97641d3b5b40be66fd7b40f68a51dd3ea451e8045fad844464f98bfa5d29664a5
SHA1 hash: b1bc0fdfcbc5b3862965ab373ccf372b0d7b3da5
MD5 hash: 8b03ec8db93383435bab7ee5ca29dd42
humanhash: virginia-washington-delaware-mexico
File name:MV. KEY FRONTIE.cab
Download: download sample
Signature Loki
Create hunting rule
File size:576'470 bytes
First seen:2020-10-27 10:28:17 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:FIQANgGEd4g6x2P4w0ZuBIXGGxkeGLBM/ZT0sorZsjzGfd5:FiL6W+4B6u7xpGKisfHqd5
TLSH 16C4333B375C5BC75AD826C311D1646329C182F9A43665B0E6A0B412E0DFAEB3B5CB4F
Reporter abuse_ch
Tags:cab Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: xmx0.517.awnex.ml
Sending IP: 46.101.17.68
From: y-kamiariya <y-kamiariya@fmarine.co.jp>
Reply-To: ops@fmarine.co.jp
Subject: RE: MV. KEY FRONTIER (ETA: KAW THAUNG : 05-11-2020) ESTD PORT D/A
Attachment: MV. KEY FRONTIE.cab (contains "MV. KEY FRONTIE.exe")

Loki C2:
http://ytho.com.vn/.vncom/need/work/Panel/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/58bf6897e24f6b2e192e241466031b88193f066a9a3d7da15e068d80defedb26/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 05:15:23 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lc7wrf7cj5vs4gjoeqkgmay3ramt6btkti6x3ik6a2gybxx63mta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab 58bf6897e24f6b2e192e241466031b88193f066a9a3d7da15e068d80defedb26

(this sample)

Loki

Executable exe 51d234e3c760e0145e76958a2fc84c583f3e5e3af6bf5f36508b8cd6d557e4e8

  
Dropping
MD5 a893898a0aa16d09c42ef89c1fd1c9fc
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 51d234e3c760e0145e76958a2fc84c583f3e5e3af6bf5f36508b8cd6d557e4e8

Comments