MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca5ce2b230611406627778b4819ea3953a892bce067c5529a3ed2980c82ab343. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca5ce2b230611406627778b4819ea3953a892bce067c5529a3ed2980c82ab343
SHA3-384 hash: e79c86b7f984f3aa5dec05d2a98eee5c759815a5f7e844c8923e27ba55be68665b2b02577950c2ecef90862e941fed04
SHA1 hash: 4b74cd7af087bfc9a7720aaa8a2b60f674abf7c1
MD5 hash: d3a6023d68a5576e1fd7d95db6750aaf
humanhash: maryland-virginia-friend-william
File name:New Order=0013.zip
Download: download sample
Signature Loki
Create hunting rule
File size:176'369 bytes
First seen:2021-02-02 19:50:32 UTC
Last seen:2021-02-11 20:41:33 UTC
File type: zip
MIME type:application/zip
ssdeep 3072:M0YC3tfjBq4+XHX+OxjA7e3TM8RshAFa4viRpIGTLDJd7UkFTuR8IWTrtP:M1C9Nz+X1O7e48RsqIIGTfb7UITi1Ch
TLSH A80423CE6D14FBF423673452F1876B3355A73171810CEA8A2C4107B7867A6AFBEA4246
Reporter GovCERT_CH
Tags:Loki

Intelligence

File Origin
# of uploads :
16
# of downloads :
135
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Generic-9822493-0
Create hunting rule

PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Sanesecurity.Malware.22623.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ca5ce2b230611406627778b4819ea3953a892bce067c5529a3ed2980c82ab343/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-02-02 08:43:51 UTC
AV detection:
13 of 45 (28.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zjoofmrqmekamytxpc2idhvdsu5isk6oaz6fkknd5uuybsbkwnbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ca5ce2b230611406627778b4819ea3953a892bce067c5529a3ed2980c82ab343

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip ca5ce2b230611406627778b4819ea3953a892bce067c5529a3ed2980c82ab343

(this sample)

Loki

Executable exe 924a523ffd992e6ff880c4945d7edf48ff9eeb73c4477a50bcd61b89b59d122c

  
Dropped by
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 924a523ffd992e6ff880c4945d7edf48ff9eeb73c4477a50bcd61b89b59d122c
  
Dropping
MD5 ed01f954c6a255e2b30c97b19842d326

Comments