MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4f3f489c159efd60ff8cdf584f357f2044586c5c5d4b23db8d322b2aea9a141. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loda


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4f3f489c159efd60ff8cdf584f357f2044586c5c5d4b23db8d322b2aea9a141
SHA3-384 hash: 8937b0cbe592017f3eb05b40345299669a1a197bd62620fca4711156d1b49f6178842f4f492fddf6aa9a272bdc2fdb25
SHA1 hash: 44059b5e8c35aa64faecde0a1672b3ac5815a009
MD5 hash: d7e8f3f1577e494ab9e3875aeb05838a
humanhash: nine-butter-nineteen-burger
File name:Order.pfg.rar
Download: download sample
Signature Loda
Create hunting rule
File size:1'301'727 bytes
First seen:2020-05-05 07:26:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:SDda2qU/mX0ntOKbvuDuaV43ixJucaojpoKAOmBnidgMMm/3IHJm:SDI2rA0lvuCq43qkoNxCnidfMm/4E
TLSH 9B553347091DC8BF1AC5EFD7E28CEFDD3480803C8C53665B8D5AB9429A587B522E28F1
Reporter abuse_ch
Tags:Loda rar


Avatar
abuse_ch
Malspam distributing Loda:

HELO: slot0.airwestmechanical.cf
Sending IP: 64.190.90.61
From: Air West M. LLC <info@airwestmechanical.cf>
Reply-To: Air West M. LLC <airwestm@unamaf-undp.org>
Subject: Re: Order
Attachment: Order.pfg.rar (contains "Order.pfg.exe")

Loda C2:
unama.duckdns.org:4000 (37.230.175.86)

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 07:35:50 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
17 of 31 (54.84%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wtz7jcoblhx5md7yzx2yj42x6icelbwfyxklepny2mrlflvjufaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loda

rar b4f3f489c159efd60ff8cdf584f357f2044586c5c5d4b23db8d322b2aea9a141

(this sample)

Loda

Executable exe e4319ba20af83dd8ba6041fd70c3c27dc2c79c648de642487fc1a217e0549fc8

  
Dropping
MD5 da2f7a1f37ff269219662ab3a4488aa1
  
Dropping
Loda
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e4319ba20af83dd8ba6041fd70c3c27dc2c79c648de642487fc1a217e0549fc8

Comments