MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8dc3f63575a4792c708effdc60a472719e1a78238d6867a88be646183c20b9d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8dc3f63575a4792c708effdc60a472719e1a78238d6867a88be646183c20b9d
SHA3-384 hash: 2072fa00de86d9b1914428190788d3d1e4d4c28a3725705dd5781538e207f78934a3372b4f72b2a218bf1bbcf7095ac0
SHA1 hash: cd1f14d7ed72a6ed730eb035397802bafdd42a0d
MD5 hash: c8fac8310ce02639f82871c3725fee91
humanhash: magnesium-kilo-south-two
File name:IMG_056719.xls.iso
Download: download sample
Signature Loki
Create hunting rule
File size:1'769'472 bytes
First seen:2021-01-14 20:19:26 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:cUSqOgs7RD+FhkKNO4jfCbN89tQ7itPEodq0sz83nTMHy2rO2B+3uzl82MznKizq:kMs0zbNj6u9M63gjra22u60P
TLSH DA85C342F7A1CE40E070393693AD8E291F62FEDF19269569631DFE609E771C22C4DAC4
Reporter abuse_ch
Tags:iso Loki


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: soa0.504.jxwi.cf
Sending IP: 46.101.90.212
From: antoine.ifono@sonoco-sa.com
Subject: order 2021_056719
Attachment: IMG_056719.xls.iso (contains "IMG_056719.xls.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
149
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs2061.UNOFFICIAL
Create hunting rule

PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d8dc3f63575a4792c708effdc60a472719e1a78238d6867a88be646183c20b9d/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-14 17:08:00 UTC
AV detection:
10 of 29 (34.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3dod6y2xljdzfryi5764mcshe4m6dj4chdlim6uixzsgda6cbooq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d8dc3f63575a4792c708effdc60a472719e1a78238d6867a88be646183c20b9d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

iso d8dc3f63575a4792c708effdc60a472719e1a78238d6867a88be646183c20b9d

(this sample)

Loki

Executable exe 22df9f21a06e39c218062e506094cd16b272094b941c729c4a7c510145509034

  
Dropping
MD5 f92036fc54ce0735a7af4f53d9511937
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 22df9f21a06e39c218062e506094cd16b272094b941c729c4a7c510145509034

Comments