MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59085b724f9551c26acc6784a49a2c1f1c3431f25db428697f2bd623cc327850. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 59085b724f9551c26acc6784a49a2c1f1c3431f25db428697f2bd623cc327850
SHA3-384 hash: 6f33260c518f1d2072df5b0ef612fc687c3af2295965cd98197f5d289ebfd26f54f840fbbf5fdf42a18f78e176fd9806
SHA1 hash: 3bcc9172cd8e9bf29cc4299b9f8d44b73631abf6
MD5 hash: 1b29e8701518a3f7f6143790440dba4b
humanhash: delaware-fix-fifteen-lemon
File name:EFT Voucher_14.01.2021.tar
Download: download sample
Signature Loki
Create hunting rule
File size:573'440 bytes
First seen:2021-01-14 20:05:04 UTC
Last seen:Never
File type: tar
MIME type:application/x-tar
ssdeep 6144:kjNWKDiJDRONPAkCO5CwouOBFkujGMdttqEWpQasBrrN2kXtip2dUesC659lnnPu:kkNxgtFCWCXrJfepeBVUIUeE9tvX
TLSH 7FC4120522F92F52EAFB5BFB5AA0800007B6786776B2F32C1ED634D52163F60DA91717
Reporter abuse_ch
Tags:Loki tar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mageneet.com
Sending IP: 45.145.185.72
From: Vindhya Shipping Co.Ltd. <acct1@vindhyashipping.com>
Subject: RE: Re: Payment Notification_INV.5199/ 14.01.2021
Attachment: EFT Voucher_14.01.2021.tar (contains "EFT Voucher_14.01.2021.exe")

Loki C2:
http://51.195.53.221/p.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
150
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen11.57608.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/59085b724f9551c26acc6784a49a2c1f1c3431f25db428697f2bd623cc327850/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-14 20:06:06 UTC
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=leefw4spsvi4e2wmm6ckjgrmd4odimpslw2cq2l7fplchtbspbia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/59085b724f9551c26acc6784a49a2c1f1c3431f25db428697f2bd623cc327850

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

tar 59085b724f9551c26acc6784a49a2c1f1c3431f25db428697f2bd623cc327850

(this sample)

Loki

Executable exe 3622005ae3bfc501cdba1551166885af68fbdf4deb6b780880e8b1e71e8f3cf5

  
Dropping
MD5 ca25099e33acb6008ecc6f448270685c
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3622005ae3bfc501cdba1551166885af68fbdf4deb6b780880e8b1e71e8f3cf5

Comments