MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cca35567d29e2a8e7482eb16d6e899f97aac6e58e018fdba65960c72c0228eda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cca35567d29e2a8e7482eb16d6e899f97aac6e58e018fdba65960c72c0228eda
SHA3-384 hash: f2831b39913158c01811bff68e46391ca8e9a9e6124f09de0b68281528838b4696668f82ee6fae9b20aa7ca0299aec62
SHA1 hash: e73ed310b3bcc84bb136802ec402a6f8bbf15d9a
MD5 hash: b95fd11f567ffffc67ec63885c066327
humanhash: quebec-golf-hotel-eight
File name:SC-08453.gz
Download: download sample
Signature Loki
Create hunting rule
File size:392'572 bytes
First seen:2020-11-20 07:54:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:CFWt8sF/cJSPsb0hDTnnA5VJFLHPbmFUgcR1swMUR6WFOXQtqHjqWDtj6YWNe6d7:CqpFkJOsbY4fnR1swMI0XQmTQYs7
TLSH A484230976F2211AB24CA141BA75FE05B0E2618EF2B547AC677B8E5C5CF5BDC814CE0B
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server3.elighthost.com
Sending IP: 173.249.38.250
From: Charlesworth, Ivan <ivan@positivedesign.com.sg>
Subject: INVOICE & STATEMENT FOR OCTOBER
Attachment: SC-08453.gz (contains "SC-08453.exe")

Loki C2:
http://lmpulsefashion.net/bryt/bryt3/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cca35567d29e2a8e7482eb16d6e899f97aac6e58e018fdba65960c72c0228eda/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-20 07:55:08 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zsrvkz6styvi45ec5mlnn2ez7f5ky3sy4amp3otfsyghfqbcr3na._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip cca35567d29e2a8e7482eb16d6e899f97aac6e58e018fdba65960c72c0228eda

(this sample)

Loki

Executable exe c2adef081476b989db9efaedd02e43eb0b231a0b6d97f3ceeff20b1d52112a9c

  
Dropping
MD5 a164c461769125ce3b5a144312c2b4a2
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c2adef081476b989db9efaedd02e43eb0b231a0b6d97f3ceeff20b1d52112a9c

Comments