MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b28edc545e4bd7842b0c254a7345ca0de1c3565ea1774c98140318ba382af93d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b28edc545e4bd7842b0c254a7345ca0de1c3565ea1774c98140318ba382af93d
SHA3-384 hash: 5efe2bf6090b6c3972d8a9b4bd81e7f981c053509e085644b6c8e7b7da987fd17a3d2b26428651b024546d462395d810
SHA1 hash: 500994661325df47abd85df261aa7bcb66959847
MD5 hash: 9cba90daadca9ea77d7325966deb15b3
humanhash: west-river-cola-india
File name:kwitansi bank 0070620200012-pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:374'233 bytes
First seen:2020-08-17 06:55:51 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:ozmAZ7IITi+qn4c+A50TkA+P/MnpBygHRzU4skmunTDzMg4ITGlrGTrEbmiR1f8Z:CCnYA51UpBfzUV4tJGJUQ1H98
TLSH CE84232E437996E718BF0C0698B1A4BDEE84AF45F952F144E33DAB4AE790C91419F433
Reporter abuse_ch
Tags:gz Loki MailChannels


Avatar
abuse_ch
Malspam distributing Loki:

HELO: fossa.birch.relay.mailchannels.net
Sending IP: 23.83.209.62
From: PT Bank Maybank <arya@dimensilogistic.co.id>
Subject: Bukti Transaksi !!!
Attachment: kwitansi bank 0070620200012-pdf.gz (contains "kwitansi bank 0070620200012-pdf.exe")

Loki C2:
http://buildbd.org/slid/_notes/Panel/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.77d8b7dfa6cd1ce8.31529.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b28edc545e4bd7842b0c254a7345ca0de1c3565ea1774c98140318ba382af93d/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 06:57:08 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wkhnyvc6jplyikymevfhgrokbxq4gvs6uf3uzgauammluobk7e6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b28edc545e4bd7842b0c254a7345ca0de1c3565ea1774c98140318ba382af93d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz b28edc545e4bd7842b0c254a7345ca0de1c3565ea1774c98140318ba382af93d

(this sample)

Loki

Executable exe 22016decae5f551ae72ddfee99c9a2064dc3dd138d3fe89fb4c56f8fb4d432cd

  
Dropping
MD5 77d8b7dfa6cd1ce859128493c6468bb1
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 22016decae5f551ae72ddfee99c9a2064dc3dd138d3fe89fb4c56f8fb4d432cd

Comments