MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c12c211cb7fb30cb0706e90acedba5c42d3589db5145e1a5d6adf9ee62a9e3f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c12c211cb7fb30cb0706e90acedba5c42d3589db5145e1a5d6adf9ee62a9e3f7
SHA3-384 hash: 12fabaeb093bec8d8904aa76111210780abf6bb4d9485b23d47b90e09d6f3bac4d6775b5b50a79c2b54a72f6c09a49d7
SHA1 hash: 09d8ef2e2c5b06716f251ea788f02fd4b3e69b31
MD5 hash: e37cbd77c7b156730705f87bb2375ed7
humanhash: island-music-bravo-princess
File name:Purchase Order 2834_PDF.xz
Download: download sample
Signature Loki
Create hunting rule
File size:162'123 bytes
First seen:2021-03-03 10:20:58 UTC
Last seen:2021-03-10 02:27:34 UTC
File type: zip
MIME type:application/zip
ssdeep 3072:c4PBR9lJXkN4wbcmqFhdovvB2K6x31tGYmtEHDL3OsUKzQkEaH0u+qwrCwF:c4PBVJ0Swbczd4BgrtSEjz4i0mwrF
TLSH DDF312A01D931A15C689FFC6B9FF1A960F22EB2F069244255CE9B085690F4DD6C7F0B8
Reporter cocaman
Tags:Loki xz


Avatar
cocaman
Malicious email (T1566.001)
From: "SeouLin <wonjun-cha@seoulin.co.kr>" (likely spoofed)
Received: "from seoulin.co.kr (unknown [64.44.139.163]) "
Date: "03 Mar 2021 11:13:56 +0100"
Subject: "Purchase Order 24432 from SeouLin Bioscience Co., Ltd (Korea)"
Attachment: "Purchase Order 2834_PDF.xz"

Intelligence

File Origin
# of uploads :
11
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_badexts14.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c12c211cb7fb30cb0706e90acedba5c42d3589db5145e1a5d6adf9ee62a9e3f7/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 00:37:17 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yewcchfx7mymwbyg5efm5w5fyqwtlco3kfc6djowvx464yvj4p3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Gamarue
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c12c211cb7fb30cb0706e90acedba5c42d3589db5145e1a5d6adf9ee62a9e3f7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip c12c211cb7fb30cb0706e90acedba5c42d3589db5145e1a5d6adf9ee62a9e3f7

(this sample)

Loki

Executable exe a96bdbf711ffdebd8d6ba0956725d697253ec435362c1a7e533890b827d55c19

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a96bdbf711ffdebd8d6ba0956725d697253ec435362c1a7e533890b827d55c19
  
Dropping
Loki

Comments