MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aee6337d118dcc4f383b887e1ba9435d74a27136206cf372146a137449d6955c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aee6337d118dcc4f383b887e1ba9435d74a27136206cf372146a137449d6955c
SHA3-384 hash: f05d92f4bcfbc24e7660a1cdcf2b55bbd58423fa44d4fbead8d3179b3ad13764a8d192fa8bb469a73f06e36012345f00
SHA1 hash: 8677be78135ad942cd0d3552e760ead215b050a5
MD5 hash: 8dcc14449fd7093ba0cce41a330963f5
humanhash: bluebird-happy-helium-freddie
File name:IMG_06176.pdf.iso
Download: download sample
Signature Loki
Create hunting rule
File size:1'835'008 bytes
First seen:2021-01-19 13:00:35 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:XNZLw8pCy3DF/5892Rfx7iaQ7itPEodq0sz83nTgBDpcRBClVIQDOhdzwHs9DHw9:9pCyzF/B1XM63sBDpcBFQKj3TXf3bc
TLSH 8A85E706E20DC643C154387645AB2B6C0362D5DBF641CFC5770A7B3EB6A2FC69D8A1AC
Reporter abuse_ch
Tags:iso Loki


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ycg0.226.bnjo.ml
Sending IP: 138.68.61.227
From: zia@alauddingroup.com
Subject: PO- New Order 06176.
Attachment: IMG_06176.pdf.iso (contains "IMG_06176.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
138
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs2061.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aee6337d118dcc4f383b887e1ba9435d74a27136206cf372146a137449d6955c/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 11:53:44 UTC
AV detection:
9 of 29 (31.03%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v3tdg7irrxge6ob3rb7bxkkdlv2ke4jwebwpg4qunijxisowsvoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/aee6337d118dcc4f383b887e1ba9435d74a27136206cf372146a137449d6955c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

iso aee6337d118dcc4f383b887e1ba9435d74a27136206cf372146a137449d6955c

(this sample)

Loki

Executable exe cc7d19e6c4fcae8326db313f78e56ad4e9f7346912c2f4d909e3620c1c22147f

  
Dropping
MD5 af5e99b838ae10dbc1e7cedc58413b06
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cc7d19e6c4fcae8326db313f78e56ad4e9f7346912c2f4d909e3620c1c22147f

Comments