MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b18753f13ccde34ed4a1a4ae5afe4e58b70bc624e3179d7fdc1e15f895d4770f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b18753f13ccde34ed4a1a4ae5afe4e58b70bc624e3179d7fdc1e15f895d4770f
SHA3-384 hash: 2108955c8452d238ffef4d97c371344b20ee81994f54b238b9cfb2883c5ed36f5740a05c1393c333046a79a0d2a02c2c
SHA1 hash: 20d968c94863bbc18a76ad2950c468ba2e8eef32
MD5 hash: 69fb7d704552ca0a869a469d6280ca49
humanhash: six-sodium-fix-black
File name:견적 만.cab
Download: download sample
Signature Loki
Create hunting rule
File size:412'243 bytes
First seen:2020-10-12 05:51:11 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:PAWdruq4rOKkFDr6+5W8RdmQhu0xjob9PPu52:oWRukPDr6+hRdluCj422
TLSH 30942394174396EDD4FF34E9F6806DFB27E60633A70CABBD81FE04181E6909345C9A86
Reporter abuse_ch
Tags:cab geo KOR Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail-smail-vm29.hanmail.net
Sending IP: 203.133.180.213
From: 이채원 차장 / KHE <yuho2417@daum.net>
Subject: 견적 만
Attachment: 견적 만.cab (contains "po.exe")

Loki C2:
http://79.124.8.8/plesk-site-preview/coautomaquinaria.com/http/79.124.8.8/white/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b18753f13ccde34ed4a1a4ae5afe4e58b70bc624e3179d7fdc1e15f895d4770f/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 01:56:47 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wgdvh4j4zxru5vfbusxfv7solc3qxrre4mlz2764dyk7rfouo4hq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b18753f13ccde34ed4a1a4ae5afe4e58b70bc624e3179d7fdc1e15f895d4770f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab b18753f13ccde34ed4a1a4ae5afe4e58b70bc624e3179d7fdc1e15f895d4770f

(this sample)

Loki

Executable exe 8b153c32e397a1c5a47b67cd4306a8d946607fecba641ac2986b8e330af5193d

  
Dropping
MD5 5b635028abf4b8f711376c894077e4d2
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8b153c32e397a1c5a47b67cd4306a8d946607fecba641ac2986b8e330af5193d

Comments