MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb62a80b840578e23fba48a5b7e6c352cacd582048837fd12918ded8f6dc654e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb62a80b840578e23fba48a5b7e6c352cacd582048837fd12918ded8f6dc654e
SHA3-384 hash: a113ad43b77cb1a7cea2996173f4e5693497064f1ff132bfed43075de585ca6fcbbdd42943b665b63782d6552836d67e
SHA1 hash: f4caffc426863230e5033b735ec2c456fc71e849
MD5 hash: 8c68db1f2edfd8b5f7fcb164b22bad8a
humanhash: bakerloo-oscar-bravo-early
File name:Documents.recent.img.jpg.lib.zip
Download: download sample
Signature Loki
Create hunting rule
File size:340'490 bytes
First seen:2020-12-07 16:26:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:qVWM50t5NoTaIdxgG/48mluxflUcljSY/QnwHf6JXvrwy/N6Kpq8RKGNvGo:qVn5S5NC4GckjSqx/6ZfUEKGN1
TLSH 8974236CDC095D2B60016CF7E31BED01CAB56761E9579FFE6AC4131842C0E18989ECEE
Reporter cocaman
Tags:Loki zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Laura Fortin <info1@garzoni.com>" (likely spoofed)
Received: "from garzoni.com (unknown [103.53.41.195]) "
Date: "7 Dec 2020 21:12:22 +0530"
Subject: "Request for quotation."
Attachment: "Documents.recent.img.jpg.lib.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis4034CA4455DE.28618.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb62a80b840578e23fba48a5b7e6c352cacd582048837fd12918ded8f6dc654e/
Threat name:
ByteCode-MSIL.Trojan.Masson
Create hunting rule
Status:
Malicious
First seen:
2020-12-07 15:58:48 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=znrkqc4eav4oep52jcs3pzwdklfm2wbajcbx7ujjddpnr5w4mvha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
MassLogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cb62a80b840578e23fba48a5b7e6c352cacd582048837fd12918ded8f6dc654e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip cb62a80b840578e23fba48a5b7e6c352cacd582048837fd12918ded8f6dc654e

(this sample)

Loki

Executable exe ca6c0702ac45a81d1971f4411e553a85a5372c21d38638e5af8322f5605120f3

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ca6c0702ac45a81d1971f4411e553a85a5372c21d38638e5af8322f5605120f3
  
Dropping
Loki

Comments