MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b82acd4633c5481c12efad1c770daedce6cadc25710e8112bf9343792fde665f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b82acd4633c5481c12efad1c770daedce6cadc25710e8112bf9343792fde665f
SHA3-384 hash: ca5a5fbf11a90f5ccc0d65ba860fa298d206e0d9676dc237e2bdb513bb91ec2f7c613293d38b0548e4924ff2f7b45316
SHA1 hash: 205fc630026bdf243cf52fda3a673153bc0b4e20
MD5 hash: 103d404396590bdd24c24626d16fa978
humanhash: robin-fillet-echo-thirteen
File name:Invoice 007_packing list.iso
Download: download sample
Signature Loki
Create hunting rule
File size:1'212'416 bytes
First seen:2020-06-18 07:39:49 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:ftb20pkaCqT5TBWgNQ7ahxr/4/17ego6A:cVg5tQ7ahN/4/1c5
TLSH 5545AE1363DE8364C3BE51737A1577016EBB782906A1F4FB2FD8093CAA501215E1E6AF
Reporter cocaman
Tags:iso


Avatar
cocaman
Malicious email
From: import1@clsteam.pk
Received: from clsteam.pk (unknown [45.137.22.101])
Date: 18 Jun 2020 00:04:53 -0700
Subject: Preshipment Documents
Attachment: Invoice 007_packing list.iso

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 01:15:56 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
14 of 26 (53.85%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xavm2rrtyvebyexpvuohodno3ttmvxbfoehicev7snbxsl66mzpq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

iso b82acd4633c5481c12efad1c770daedce6cadc25710e8112bf9343792fde665f

(this sample)

Loki

Executable exe dfeb957fc25e4102bf74a28e214d8ad5488d85b552824e0cd1f3c856f3a62acc

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dfeb957fc25e4102bf74a28e214d8ad5488d85b552824e0cd1f3c856f3a62acc

Comments