MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ceaac47d3715c213e6cf37d627d6a491495cca77c92b77efd0cbb40caf1d68da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ceaac47d3715c213e6cf37d627d6a491495cca77c92b77efd0cbb40caf1d68da
SHA3-384 hash: 6c0d83b0e7798004e918929d8b14f2152e68119ccebec3287676ccd4c134e3a8225cf1acc3a17142ad82b221b2eaa7ea
SHA1 hash: 572419b5a86a81c774fe5255abaf7683ad7af29f
MD5 hash: 344c6163dcf0b9868396122a9a128351
humanhash: cup-aspen-spring-oklahoma
File name:New Order_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:183'336 bytes
First seen:2020-06-19 06:07:25 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 3072:Ccw6sNpFSWLJYcWp39JG8DuRKuzPL8NHNB2Rwu3n4FkDjuYqeO+mtzMGe3kK:Zw60wBpNrML8VeRGkjqxakK
TLSH 61041285E8D0098AC2B088161FA46BEB15E74F49A25F2D2F5E90D28E19CDFC7F706774
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

From: "Decor (Suzhou) Co., Ltd." <no-replay@mkinn.com>
Subject: PO#METGT1058
Attachment: New Order_pdf.gz (contains "330udmb5.jlw.exe")

Loki C2:
http://abiz-solutoins.com/mine/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-19 06:09:07 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z2vmi7jxcxbbhzwpg7lcpvvesfevzstxzevxp36qzo2azly5ndna._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz ceaac47d3715c213e6cf37d627d6a491495cca77c92b77efd0cbb40caf1d68da

(this sample)

Loki

Executable exe aa530c5bf4006eb53797d6617fce896f3ac536f35c596afcee611f9b8649f4a9

  
Dropping
MD5 ca4b7609bb32f8aaef6e6350d746b863
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 aa530c5bf4006eb53797d6617fce896f3ac536f35c596afcee611f9b8649f4a9

Comments