MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd8d511b627e86922a6bc224751f918f2272f9352fcd7e0dd66a081e4f535d17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd8d511b627e86922a6bc224751f918f2272f9352fcd7e0dd66a081e4f535d17
SHA3-384 hash: a61c240bea404f26e56a4994d777e2396f0631ca86dcae8bea554839a5543f5137b9357828e1cf784f5d91c877ae82d7
SHA1 hash: 14a32e556f3cc53ef6a1b9e95ca3427036ad7b71
MD5 hash: 5f037a5012768f04bdaf43260acd8055
humanhash: alanine-stairway-august-yankee
File name:SOA OCT-NOV 2021.arj
Download: download sample
Signature Loki
Create hunting rule
File size:222'966 bytes
First seen:2021-11-02 06:54:14 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:r7TOtvJne8Q2K/8PSuTrn8W1nl9zG40+mJ8EVc0e4E:jOtRe8xK/qSuRl9G+m/2ME
TLSH T16B24233082155198C4D6B78EF7BEAC09016FB975ADF4D9CE48BFB5243A42495F02FAC0
Reporter cocaman
Tags:arj Loki


Avatar
cocaman
Malicious email (T1566.001)
From: "Andrei Vargas <CSanchez@pecsa.com.pe>" (likely spoofed)
Received: "from hp0.avarvon.bar (unknown [204.48.30.230]) "
Date: "Mon, 01 Nov 2021 18:21:17 -0700"
Subject: "RE: SOA 2021815"
Attachment: "SOA OCT-NOV 2021.arj"

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6180e0c9bf51178dbe47e0d5/reports/5a409ce8-afd6-4103-9ad9-c4856597c48d/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd8d511b627e86922a6bc224751f918f2272f9352fcd7e0dd66a081e4f535d17/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-11-02 03:14:06 UTC
AV detection:
9 of 44 (20.45%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zwgvcg3cp2djektlyishkh4rr4rhf6jvf7gx4downieb4t2tlulq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/cd8d511b627e86922a6bc224751f918f2272f9352fcd7e0dd66a081e4f535d17

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

arj cd8d511b627e86922a6bc224751f918f2272f9352fcd7e0dd66a081e4f535d17

(this sample)

Loki

Executable exe d9e92535d5c9c9dd3a2879f6f87940c80a7c80820298ad369922783130dfcb6d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d9e92535d5c9c9dd3a2879f6f87940c80a7c80820298ad369922783130dfcb6d
  
Dropping
Loki

Comments