MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87cf1ce2b4a326462ef80a6d0ac2456733dd62e485d8fccc60a50cf9d499bdc9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87cf1ce2b4a326462ef80a6d0ac2456733dd62e485d8fccc60a50cf9d499bdc9
SHA3-384 hash: faf2aac4c865451454a934ae9b1c71c80b2d56637dfe5cef788e0ffb825a4474f34872a359aa5d8b8a5d1f4d63d84b9c
SHA1 hash: 8e4b2c0499221ecaa8ed53b956a58463914088cc
MD5 hash: 793a378976bebfe1afc6582406878780
humanhash: september-hawaii-angel-arkansas
File name:Quote.cab
Download: download sample
Signature Loki
Create hunting rule
File size:496'636 bytes
First seen:2020-10-06 06:14:53 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:/OCG81kLrc5sncv2L1b60rL4BWc6IOxwKXdhm+w2O:mG1kLrcGch0r9IODPDO
TLSH E1B4239BEDFAA2F6E8F4C83077B660D04214A532096A456D7370FF08109C6ADB55F13A
Reporter abuse_ch
Tags:cab geo KOR Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail-smail-vm45.hanmail.net
Sending IP: 203.133.180.233
From: 신형섭 <ci3m@daum.net>
Subject: 견적 만
Attachment: Quote.cab (contains "Quote.exe")

Loki C2:
http://79.124.8.8/plesk-site-preview/coautomaquinaria.com/http/79.124.8.8/white/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/87cf1ce2b4a326462ef80a6d0ac2456733dd62e485d8fccc60a50cf9d499bdc9/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 03:48:08 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q7hrzyvuumtemlxybjwqvqsfm4z52yxeqxmpztdauugptvezxxeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/87cf1ce2b4a326462ef80a6d0ac2456733dd62e485d8fccc60a50cf9d499bdc9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab 87cf1ce2b4a326462ef80a6d0ac2456733dd62e485d8fccc60a50cf9d499bdc9

(this sample)

Loki

Executable exe 503cec3d1e7545f610736aa3ee4473b3e0f28ee2bd80b682e8d8f687c2410008

  
Dropping
MD5 4bbd611756a4a042821a78f08c1e77e3
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 503cec3d1e7545f610736aa3ee4473b3e0f28ee2bd80b682e8d8f687c2410008

Comments