MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 959c88a25d3e1a032ca06acb085d78d7e2d21592954647d9f1b5e8a65d06347c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 959c88a25d3e1a032ca06acb085d78d7e2d21592954647d9f1b5e8a65d06347c
SHA3-384 hash: d0fefbf381dff30e9257230bd9f20f7547073926ca954c0590e71277c8cf0e0adf9161da6564d86bfc3923ed1d892353
SHA1 hash: bd1ee31e446a8725250c8d29cbfaf4fa820e0c9f
MD5 hash: 98eab3cb675dd85226b373c7c1dcfd48
humanhash: happy-sweet-wyoming-bluebird
File name:SWIFT Transfer 103 049FT01192200001.zip
Download: download sample
Signature Loki
Create hunting rule
File size:411'189 bytes
First seen:2020-10-27 12:42:20 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:HMhNTPBKpWSRbmBSSGrRirdPyeMLGCEOjZaJSbygq2iHx3ULw+Ih2+IIInlH8yJT:shJopWSRbmSORyEA3qzHx2w+IUhLnlHF
TLSH 129423A359EF5B420DC177A94A3B2F3A08D61EE977F957E255C2697B0A24C9C2CC0CC1
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: arsaconsultant.com
Sending IP: 95.168.173.163
From: 陈龙 Tony Chen<info@arsaconsultant.com>
Subject: Fwd: Payment advice for the 2nd shipment - NO: #29007071
Attachment: SWIFT Transfer 103 049FT01192200001.zip (contains "SWIFT Transfer (103) 049FT01192200001.exe")

Loki C2:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/959c88a25d3e1a032ca06acb085d78d7e2d21592954647d9f1b5e8a65d06347c/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 11:16:15 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=swoiris5hynaglfanlfqqxly27rnefmssvdepwprwxukmxiggr6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/959c88a25d3e1a032ca06acb085d78d7e2d21592954647d9f1b5e8a65d06347c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 959c88a25d3e1a032ca06acb085d78d7e2d21592954647d9f1b5e8a65d06347c

(this sample)

Loki

Executable exe 6c158739571ce4a16b3cf705310480c884e292d80d04e74ff2e2644a488ad644

  
Dropping
MD5 e751e9518ee7db89b5c7935313f928e4
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6c158739571ce4a16b3cf705310480c884e292d80d04e74ff2e2644a488ad644

Comments