MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c220e9bb36ba6fc285976dd934d60844bcaa4e94db30b631c52c42b8f5cdce6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8c220e9bb36ba6fc285976dd934d60844bcaa4e94db30b631c52c42b8f5cdce6
SHA3-384 hash: b68b74c1acef1a4534b8cf1fda52eacfbffcd172e9f4f3f8c34e771f619701ec539584cb97626a98fda3b16db45fcc75
SHA1 hash: 4d1e4149bc34e846674117bb1d73ae2ad79fccb6
MD5 hash: 636e77f7d068f80b1ae395c2bec0550f
humanhash: river-timing-harry-fix
File name:Tender_documents_FOB_Offer_Printout.PDF.arj
Download: download sample
Signature Loki
Create hunting rule
File size:184'499 bytes
First seen:2021-01-18 07:37:52 UTC
Last seen:2021-01-18 08:34:21 UTC
File type: arj
MIME type:application/x-rar
ssdeep 3072:pdEKB9KdfL2EvasLNnoP2u5sOpUbLF8737tnr0DFgqLPQ8sv6k7VG1PnNDTM:rB9sDatP2AsOpUbLa7mDOqLP46CGfM
TLSH 3404126DF7B1D29F290F0A6759C6C8DB3D6077019A9B0BE6B332067F1A25C4C0E528D6
Reporter lowmal3
Tags:Loki

Intelligence

File Origin
# of uploads :
3
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8c220e9bb36ba6fc285976dd934d60844bcaa4e94db30b631c52c42b8f5cdce6/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-18 07:38:05 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rqra5g5tnotpykczo3ozgtlaqrf4vjhjjwzqwyy4klccxd243tta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8c220e9bb36ba6fc285976dd934d60844bcaa4e94db30b631c52c42b8f5cdce6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

arj 8c220e9bb36ba6fc285976dd934d60844bcaa4e94db30b631c52c42b8f5cdce6

(this sample)

Loki

Executable exe cb41e0c21ab793585bc15d5ad39d5d842cbdea326324e5994f5fa5e2e3dc3f27

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cb41e0c21ab793585bc15d5ad39d5d842cbdea326324e5994f5fa5e2e3dc3f27
  
Dropping
MD5 9dc1a85cf320f15b734128c1fa984be9

Comments