MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b93ec176403d84a92d043b44c0ef457d9a9f912d92d2c97d5efb0fa46c499018. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b93ec176403d84a92d043b44c0ef457d9a9f912d92d2c97d5efb0fa46c499018
SHA3-384 hash: 930ae449ca7300d3fb984534ceed2b708a77d807361d772432d5239c80a41dd9cd33940522e2f43d927ee150e981847d
SHA1 hash: 0004d7c784b6399b8d27f55dd6c0b56b88412df0
MD5 hash: 6a92bcd817e489e5c6b430c3d3658c7a
humanhash: hydrogen-failed-fourteen-oklahoma
File name:NAUJAS PASIŪLYMO PRAŠYMAS 05-10-2020pdf.rar
Download: download sample
Signature Loki
Create hunting rule
File size:332'407 bytes
First seen:2020-10-05 11:43:54 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:THf69SFSKgy1Ev51Knme6U7dlytjZBZl02swlVs+2ym/H6zKael/laTrJjTSRswX:THfBTF1EbK1P7dUtVBZl02RlVxzgdaPk
TLSH DF642311FDE3359BB84F91903885B833720D6DE707CA1D26E63337A3B56529A41177A3
Reporter abuse_ch
Tags:geo Loki LTU rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server.linux69.papaki.gr
Sending IP: 88.99.0.236
From: Lietuvos sveikatos mokslų universitetas <webmaster@lsmuni.lt>
Subject: RE: NAUJAS PASIŪLYMO PRAŠYMAS (Lietuvos sveikatos mokslų universitetas) EUI894/LT4600
Attachment: NAUJAS PASIŪLYMO PRAŠYMAS 05-10-2020pdf.rar (contains "Rofile_pdf (1).exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b93ec176403d84a92d043b44c0ef457d9a9f912d92d2c97d5efb0fa46c499018/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 08:13:01 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xe7mc5sahwcksliehncmb32fpwnj7ejnsljms7k67mh2i3cjsama._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b93ec176403d84a92d043b44c0ef457d9a9f912d92d2c97d5efb0fa46c499018

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar b93ec176403d84a92d043b44c0ef457d9a9f912d92d2c97d5efb0fa46c499018

(this sample)

Loki

Executable exe 1421c6449272c878575bd19a79da02a2c77d88087a9d941347d6a034d525c618

  
Dropping
MD5 90ac045499fa9ada0646830994098a2c
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1421c6449272c878575bd19a79da02a2c77d88087a9d941347d6a034d525c618

Comments