MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c41ca4caa9f47f70e8da4eaca097603bba265ad1708800df61f870a3ff91af16. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c41ca4caa9f47f70e8da4eaca097603bba265ad1708800df61f870a3ff91af16
SHA3-384 hash: 8c20005a4ffd28f0c5df0e485c92a40a1ac9b9c1ce5ed5d60b010db88874895b889a8dcca8bf66a4007448ceae94292b
SHA1 hash: be27c784ae5eb39b65c08dcaa241779217e7a992
MD5 hash: bb3669764194468888f3d8bf4fee8633
humanhash: two-romeo-december-nitrogen
File name:image006.png.gz
Download: download sample
Signature Loki
Create hunting rule
File size:446'534 bytes
First seen:2020-10-27 23:38:58 UTC
Last seen:2020-10-27 23:46:51 UTC
File type: gz
MIME type:application/x-rar
ssdeep 6144:GQla5jI7lwzCaLa3pyIba6jTmX0wM2xXrk4x72KjA6t5MaEqz66BahH9n:Gga5jYwzCcM3bFJwjx7ku7A6tpp3od
TLSH D394238CDBD9DFDFAF6857055BE0309BA00BAAACDC7323969911D008E1D1718259A4FB
Reporter GovCERT_CH
Tags:Loki

Intelligence

File Origin
# of uploads :
4
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c41ca4caa9f47f70e8da4eaca097603bba265ad1708800df61f870a3ff91af16/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 03:50:48 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yqokjsvj6r7xb2g2j2wkbf3aho5cmwwroceabx3b7bykh74rv4la._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c41ca4caa9f47f70e8da4eaca097603bba265ad1708800df61f870a3ff91af16

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz c41ca4caa9f47f70e8da4eaca097603bba265ad1708800df61f870a3ff91af16

(this sample)

Loki

Executable exe 844862421cc738c8a9ab44c582999c42ba7a674fa4dd3e73a972f6e9ba455d56

  
Dropped by
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 844862421cc738c8a9ab44c582999c42ba7a674fa4dd3e73a972f6e9ba455d56
  
Dropping
MD5 aa16b1ed34bc4a7d840be824828c23d9

Comments