MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f4cec88d02c4b0d4fc0b8af18ca1bdb496976afe339ca4cc396dd5c6da4f563. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f4cec88d02c4b0d4fc0b8af18ca1bdb496976afe339ca4cc396dd5c6da4f563
SHA3-384 hash: aa200039654324948d9caf5a22ba570dd2b70f1e9ff011956482273edfcc75696d2773ab9ade8373b9519b52cee7125d
SHA1 hash: eac6e36ddba58574946cd1244c3d13de530f68d9
MD5 hash: 213bff80f6797ee0013f273b5e180639
humanhash: butter-mike-orange-minnesota
File name:TT payment.rar
Download: download sample
Signature Loki
Create hunting rule
File size:261'724 bytes
First seen:2020-08-17 06:17:21 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:MlUrtzB6Ssg3Q3M4DgolTmq6xyVQS5SJt2DYF4M9acZV7p:nRB6Pg3Lho9p+KDvM9a27p
TLSH 574423840E3AF741DE994B38F3847297917A1A23489827571BF00F8B9166F6C62F630F
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: tbs01-cpanel13-ip230.cloud9.ge
Sending IP: 188.93.90.230
From: Mahesh Rana (AHP)<noreply@anika.ge>
Reply-To: <purchase33@akhilhealthcare.com>
Subject: Re: Invoice & PL for Payment
Attachment: TT payment.rar (contains "TT Payment.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8f4cec88d02c4b0d4fc0b8af18ca1bdb496976afe339ca4cc396dd5c6da4f563/
Threat name:
Win32.Ransomware.MyxaH
Create hunting rule
Status:
Suspicious
First seen:
2020-08-17 06:19:04 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r5gozcgqfrfq2t6axcxrrsq33news5vp4m44utgds3ovy3ne6vrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8f4cec88d02c4b0d4fc0b8af18ca1bdb496976afe339ca4cc396dd5c6da4f563

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 8f4cec88d02c4b0d4fc0b8af18ca1bdb496976afe339ca4cc396dd5c6da4f563

(this sample)

Loki

Executable exe 198d05241ee46346a622e687e628fbdbe7185db3a206eaa7883b5f18f0095de2

  
Dropping
MD5 c6eff7fa929456a8dbbd7672f82db958
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 198d05241ee46346a622e687e628fbdbe7185db3a206eaa7883b5f18f0095de2

Comments