MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a588f0bf5a29cb6f90a0369afaa385e24a0caac1e774ed4162399745704d63b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a588f0bf5a29cb6f90a0369afaa385e24a0caac1e774ed4162399745704d63b
SHA3-384 hash: 24218e1632bb50a9e0250b85faade45774d75fa950403396d846f00f8f537b106eaf525e15bccfc976ba6129b653da44
SHA1 hash: 747f29138b3a7c9fdcff0e8e7d4c3f5e9fa37c6b
MD5 hash: 7f09f9b5c90f1866087db0cf0c0029e9
humanhash: eight-wyoming-bakerloo-iowa
File name:Wire Payment.rar
Download: download sample
Signature Loki
Create hunting rule
File size:288'094 bytes
First seen:2020-08-18 11:39:15 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:kPTtUjU9g7mnk5in+OaVz7ng4Ki4H+2OJO8G/SyWkQ9B2u8e1I1:MUjU9gi19apKdtR3Q9Bb7i1
TLSH 935423AFA8E5B2F74FA5DA5861A22BCF21358073D5CC47DADC260B59731E833392484D
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: secretariavirtual.es
Sending IP: 89.140.72.157
From: "MENUEL, Karine"<nak@naksystem.com>
Reply-To: <kmenu@kidilizgroup.com>
Subject: AW: wire confirmation
Attachment: Wire Payment.rar (contains "Wire Payment.exe")

Loki C2:
http://modevin.ga/~zadmin/lmark/gld/mode.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9a588f0bf5a29cb6f90a0369afaa385e24a0caac1e774ed4162399745704d63b/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 11:03:21 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tjmi6c7vukoln6ikanu27krylyskbsvmdz3u5vaweomxivye2y5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9a588f0bf5a29cb6f90a0369afaa385e24a0caac1e774ed4162399745704d63b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 9a588f0bf5a29cb6f90a0369afaa385e24a0caac1e774ed4162399745704d63b

(this sample)

Loki

Executable exe 6b1df4cb218093a57a5646f0d6ece41d548fae6cce51d90d1540686d747069b6

  
Dropping
MD5 36bf2bd62487253ced42da7e7fa35320
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6b1df4cb218093a57a5646f0d6ece41d548fae6cce51d90d1540686d747069b6

Comments