MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e21cf46012a647c219205029b8e861d26b98d6296e4226b28eb4f1c402ecb49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e21cf46012a647c219205029b8e861d26b98d6296e4226b28eb4f1c402ecb49
SHA3-384 hash: 6bfe392f50e1c6dbee13ad6093d3d6a67f6630db32bfcff29056ac9db7eda8ef60ec90484cd782753e8496ab58e9d560
SHA1 hash: a3611a3ac1de819ac0091e7d25e3cedb81c8c1ad
MD5 hash: f1c394d47393ee1c97dc29ed958d70b0
humanhash: sierra-edward-football-london
File name:Chake Berberian Order.zip
Download: download sample
Signature Loki
Create hunting rule
File size:682'536 bytes
First seen:2020-11-05 15:04:40 UTC
Last seen:2020-11-09 06:53:44 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:ntGTg/n3lAvKegHQARHvhqh6Ajq/qWIc2BKaaVgja2:tGTWn1ueZQhm662
TLSH CFE433A4C508B46AF180411749C63F2C4AF8B67E3DE916D780CDAF7A7B20399EB75721
Reporter cocaman
Tags:Loki zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Chake Berberian<contact@rcassocies.com>" (likely spoofed)
Received: "from rcassocies.com (unknown [185.125.204.39]) "
Date: "05 Nov 2020 07:00:24 -0800"
Subject: "Re: Chake Berberian Order"
Attachment: "Chake Berberian Order.zip"

Intelligence

File Origin
# of uploads :
6
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5e21cf46012a647c219205029b8e861d26b98d6296e4226b28eb4f1c402ecb49/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-11-05 15:06:06 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
22 of 29 (75.86%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lyq46rqbfjshyimsaubjxdugdutltdlcs3sce2zi5nhryqbozneq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 5e21cf46012a647c219205029b8e861d26b98d6296e4226b28eb4f1c402ecb49

(this sample)

Loki

Executable exe 7a5fcc13cf5992d6ff2357b48bbd3c86ebf09c43d39d977a52dfd74a8ee4f80b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7a5fcc13cf5992d6ff2357b48bbd3c86ebf09c43d39d977a52dfd74a8ee4f80b

Comments