MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9cbc5fb7497046435291f39e7beefa2754865baf1cad0be280b929bb8ae34f55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9cbc5fb7497046435291f39e7beefa2754865baf1cad0be280b929bb8ae34f55
SHA3-384 hash: 1e3d14fbd00ea8fd44c3b3dc742e1d5b7e804de5601094ed4612dc8d8bd4720da9138e16cce4f11378e215d7c8703bbf
SHA1 hash: 809e937fd9211e4d0c1e44272ad92dc5b31b9896
MD5 hash: 3b11c1dd618468f137b0d05a9f6ed86e
humanhash: white-undress-low-table
File name:REVISED CONTRACT 2.cab
Download: download sample
Signature Loki
Create hunting rule
File size:528'671 bytes
First seen:2020-10-23 07:00:25 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:/XYfeGiuiAR4EhSzZV3BpZQjm/+rIh4xn4B+RLRtNn:wGGiwqEqpBpZ1+rKklLN
TLSH D8B423C688BDDCF37A63E3A4A4446E94CFF4BF570511F286F2044EAA91915D90EC28B5
Reporter abuse_ch
Tags:cab Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: wxw0.223.zozio.ml
Sending IP: 159.65.118.249
From: hlliam <hlliam@bricomp.net>
Reply-To: account@bricomp.net
Subject: URGENT: Shared File Email Services
Attachment: REVISED CONTRACT 2.cab (contains "REVISED CONTRACT (2).exe")

Loki C2:
http://ytho.com.vn/.vncom/need/work/Panel/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis093238354633.29814.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9cbc5fb7497046435291f39e7beefa2754865baf1cad0be280b929bb8ae34f55/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ts6f7n2jobdeguur6ophx3x2e5kimw5pdswqxyuaxeu3xcxdj5kq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab 9cbc5fb7497046435291f39e7beefa2754865baf1cad0be280b929bb8ae34f55

(this sample)

Loki

Executable exe 24c02e45ff650338b45502d2ae12062e12e99fe39b3834c3d5160b82344a053b

  
Dropping
MD5 093238354633aac260aea5b15dd18c48
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 24c02e45ff650338b45502d2ae12062e12e99fe39b3834c3d5160b82344a053b

Comments