MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c26f13f6060a93c8dc58e99f05b71f2208a5ff3b80ac8f7acfb22002ffbb83d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 4 Yara Comments

SHA256 hash: c26f13f6060a93c8dc58e99f05b71f2208a5ff3b80ac8f7acfb22002ffbb83d3
SHA3-384 hash: 979d689334b7c932898d51add5a7a28fea0e5db0ba7d50a029a6f692b07bf6b369e7a4de98f23cf94bd4473c91a0c05b
SHA1 hash: 533006125b823b1c8b8852e93a629052f1d29ed4
MD5 hash: 1abb5bb6769a6247c9e07c0551e130bc
humanhash: carbon-louisiana-pizza-football
File name:SKMBT_28320062618070.zip
Download: download sample
Signature Loki
File size:230'657 bytes
First seen:2020-06-30 12:16:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:tf3ybt9jr91ToQqOMZRmCZXXy67RpXoj1ula5zwOZW9uAQi3un:N3yZ9jr91ToVgOC67Rto5uloTW5Vs
TLSH 693423076D2DCAA14B19F46DBF35FDDCDA677F623829A22E93421E39DA3C41441239C4
Reporter @abuse_ch
Tags:Loki zip


Twitter
@abuse_ch
Malspam distributing Loki:

HELO: seo.seoera.net
Sending IP: 192.254.138.161
From: Marzia Seletti <marzia.seletti@arix.it>
Subject: Statement of Pending Payment since April 2020
Attachment: SKMBT_28320062618070.zip (contains "SKMBT_28320062618070.exe")

Loki C2:
http://nightmarefile.ga/Jay/fre.php

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 29
Origin country US US
ClamAV Sanesecurity.Malware.24271.ZipHeur.UNOFFICIAL
CERT.PL MWDB Detection:n/a
Link: https://mwdb.cert.pl/sample/c26f13f6060a93c8dc58e99f05b71f2208a5ff3b80ac8f7acfb22002ffbb83d3/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Genkryptik
First seen:2020-06-30 12:18:05 UTC
AV detection:7 of 48 (14.58%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
VirusTotal:Virustotal results 13.85%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip c26f13f6060a93c8dc58e99f05b71f2208a5ff3b80ac8f7acfb22002ffbb83d3

(this sample)

  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment

Comments