MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0ceec2983b0c0e2599d24d46b85dced561ebba70b96f3b51df4e2a9585c851b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0ceec2983b0c0e2599d24d46b85dced561ebba70b96f3b51df4e2a9585c851b
SHA3-384 hash: bb7137e897595e6d8d261ea30077cecb47323aa3f079c0ae3e18285b2a1d1df3091b54b59798dbe856eed8de6fafe562
SHA1 hash: 1b51997ba7c80e93b6bb6fe1aec7f5dc52e58efb
MD5 hash: 4b5e8d1364344ec1c484b9cf5b25f81d
humanhash: ten-venus-mobile-east
File name:A-SEONG CO.,LTD.pdf.cab
Download: download sample
Signature Loki
Create hunting rule
File size:439'121 bytes
First seen:2021-01-12 07:25:55 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:xXz/IKDUU3wOHNyfbHV4ovgjZPIbFNTIQicR8fvmb38kyLkr4L:xXz/IKDUDOHNydWPIJNjXRwe38Yw
TLSH 8C9423F2B61BBB59CA5D323845E6C72BEFC6187BB8CA6077233511C550AE0EAC13D650
Reporter abuse_ch
Tags:cab geo KOR Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail-smail-vm48.hanmail.net
Sending IP: 203.133.180.236
From: A-SEONG CO.,LTD <cpctop@hanmail.net>
Subject: 견적을 긴급으로 부탁드려요.
Attachment: A-SEONG CO.,LTD.pdf.cab (contains "12012021.exe")

Loki C2:
http://45.134.225.18/plesk-site-preview/endustrigm.eu/http/45.134.225.18/garuba/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.bh.9036.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c0ceec2983b0c0e2599d24d46b85dced561ebba70b96f3b51df4e2a9585c851b/
Threat name:
ByteCode-MSIL.Trojan.Zeus
Create hunting rule
Status:
Malicious
First seen:
2021-01-12 06:12:05 UTC
AV detection:
4 of 46 (8.70%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ydhoykmdwdaoewm5etkgxbo45vlb5o5hbolphni56trkswc4qunq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c0ceec2983b0c0e2599d24d46b85dced561ebba70b96f3b51df4e2a9585c851b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab c0ceec2983b0c0e2599d24d46b85dced561ebba70b96f3b51df4e2a9585c851b

(this sample)

Loki

Executable exe a99549314a775b28d4fc30ca7b84954e631cf4267d6e76da45d5e61237774988

  
Dropping
MD5 6da4bb1a4c3fda99c848a100b7fa0367
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a99549314a775b28d4fc30ca7b84954e631cf4267d6e76da45d5e61237774988

Comments