MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc26df8fedfcf0ab9b2677672e5ff8b36b92d272584d88310d1151e7a727bae0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc26df8fedfcf0ab9b2677672e5ff8b36b92d272584d88310d1151e7a727bae0
SHA3-384 hash: 11e202c1080f80e74a411bea65accd469519a2fb4d22dd6b30ab95bf764f3250a100006759be02bb72fbce00c47b4d18
SHA1 hash: 42d55699cb9a2bdee24ea3155237bce8762b80c5
MD5 hash: 6b4f5ec658c3a02715214ff6d7a77ce2
humanhash: virginia-nebraska-william-kentucky
File name:Orden de compra (po) 2112 #.arj
Download: download sample
Signature Loki
Create hunting rule
File size:309'457 bytes
First seen:2021-10-29 07:18:17 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:VRtmvCGaDIachzF58RPfdfgTldG4uuxMGkYTjb5qLm8nPMhIz2Bynkl:ZmMDIacFFWRntgRdxuoJn1UJKInnkl
TLSH T1A56423C9029E8F25383084397EDF8268B55FCAB7682136D7DEB1716D4CE650612CBD3A
Reporter cocaman
Tags:arj Loki


Avatar
cocaman
Malicious email (T1566.001)
From: "enquiries@langdonsystems.com" (likely spoofed)
Received: "from w8.tvunbio.buzz (hp0.w8.tvunbio.buzz [143.198.225.195]) "
Date: "Thu, 28 Oct 2021 16:04:06 -0700"
Subject: "Re: New Order 202109"
Attachment: "Orden de compra (po) 2112 #.arj"

Intelligence

File Origin
# of uploads :
1
# of downloads :
161
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc26df8fedfcf0ab9b2677672e5ff8b36b92d272584d88310d1151e7a727bae0/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-10-29 07:19:07 UTC
AV detection:
18 of 44 (40.91%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zqtn7d7n7tykxgzgo5ts4x7ywnvzfutslbgyqmincfi6pjzhxlqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/cc26df8fedfcf0ab9b2677672e5ff8b36b92d272584d88310d1151e7a727bae0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

arj cc26df8fedfcf0ab9b2677672e5ff8b36b92d272584d88310d1151e7a727bae0

(this sample)

Loki

Executable exe 6f4be74e6b284f46d391aab956b83bf8ffdaf98cccdb8be8aa1648684b4ee678

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6f4be74e6b284f46d391aab956b83bf8ffdaf98cccdb8be8aa1648684b4ee678
  
Dropping
Loki

Comments