MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6238a35d4e2353a009981e6ac5d3da536132162ad4dde84c2726d14e6db0535c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6238a35d4e2353a009981e6ac5d3da536132162ad4dde84c2726d14e6db0535c
SHA3-384 hash: 19aa814207531845da177c9f5b03779c27dbf03d0fc0024a2785b76a58e9321bdc5f446980630943e28f27eb84c563c9
SHA1 hash: b63897c7522e0b292f6513535cfc2787b2f27c84
MD5 hash: c94a4ef19376f90e993312a223c69aac
humanhash: edward-lion-seven-four
File name:DHL FILE 27365493.rar
Download: download sample
Signature Loki
Create hunting rule
File size:413'811 bytes
First seen:2020-10-19 07:14:29 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:eKiOfiLBL9QQ8Gj4KJ2jXZihjwhzmQf1xRz/Fq:e9OfidlP4M2jMUhzmQjJdq
TLSH 859423F95AC34E0D013B078EA9198973D6869D859D333C8961E68BE92CD2F07F8CED11
Reporter abuse_ch
Tags:DHL Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server.filmworld.tv
Sending IP: 70.32.31.17
From: DHL Express <dhlSender@dhl.com>
Reply-To: DHL Express <dhlSender@dhl.com>
Subject: DHL On Demand Delivery
Attachment: DHL FILE 27365493.rar (contains "DHL FILE 27365493.exe")

Loki:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6238a35d4e2353a009981e6ac5d3da536132162ad4dde84c2726d14e6db0535c/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 04:28:44 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mi4kgxkoenj2acmydzvmlu62knqtefrk2to6qtbhe3iu43nqknoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6238a35d4e2353a009981e6ac5d3da536132162ad4dde84c2726d14e6db0535c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 6238a35d4e2353a009981e6ac5d3da536132162ad4dde84c2726d14e6db0535c

(this sample)

Loki

Executable exe 58bd9279e5ef2a3c1a55c9257c276f8203b69c79e29008399c6629eaf8ca6d56

  
Dropping
MD5 6ded82a178da24e319f48d2c99995482
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 58bd9279e5ef2a3c1a55c9257c276f8203b69c79e29008399c6629eaf8ca6d56

Comments