MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da148f6db526748e05071adf443fcd45c175e4fd379d50cf4eb80dc2e452f771. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da148f6db526748e05071adf443fcd45c175e4fd379d50cf4eb80dc2e452f771
SHA3-384 hash: 65dab3bdde5be903029f29ddd6b600e6f1eac2b26e04ea080ded967521005ffe512190cd20e6a5573b1953a41c844469
SHA1 hash: 993b179b135b5d94fef176f750a532949d5f74ad
MD5 hash: 5d0df4521c0d5b14d171a4cecbddba17
humanhash: finch-don-neptune-arkansas
File name:Shipping Documents Original BL, Invoice & Packing List.r04
Download: download sample
Signature Loki
Create hunting rule
File size:302'376 bytes
First seen:2021-11-03 08:09:25 UTC
Last seen:Never
File type: r04
MIME type:application/x-rar
ssdeep 6144:79AOb6rwn9fDX5RwFmAv5+jxZyJrT2ZmClqeX6oe0506qMIz63TXKYj:J36rwn9LX5el4x+aZmwq0es06ZjF
TLSH T1CD5423DD29B4C6551A45C07A368FFD853C0A2D25A6E8BB0EAF47027E14CAC72A70E5F0
Reporter cocaman
Tags:DHL INVOICE Loki r04


Avatar
cocaman
Malicious email (T1566.001)
From: "DHL Global Forwarding <Jagadeesh@bxrazov.bar>" (likely spoofed)
Received: "from hp0.bxrazov.bar (unknown [64.225.53.14]) "
Date: "03 Nov 2021 09:08:35 +0100"
Subject: "Shipment Documents Total weight is 435kgs.==WOE1910053"
Attachment: "Shipping Documents Original BL, Invoice & Packing List.r04"

Intelligence

File Origin
# of uploads :
1
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Zmutzy.903.2636.9360.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/618243dd9982ff7c3f7ce274/reports/e16180f0-8354-4a85-b96b-18cdb07fd33c/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/da148f6db526748e05071adf443fcd45c175e4fd379d50cf4eb80dc2e452f771/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-11-03 08:10:07 UTC
AV detection:
13 of 44 (29.55%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3iki63nvez2i4bihdlpuip6nixaxlzh5g6ovbt2oxag4fzcs65yq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/da148f6db526748e05071adf443fcd45c175e4fd379d50cf4eb80dc2e452f771

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

r04 da148f6db526748e05071adf443fcd45c175e4fd379d50cf4eb80dc2e452f771

(this sample)

Loki

Executable exe da1499eb6320f63efa523325b256a875cf7801181115f0ca38a50cdc211cc45b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 da1499eb6320f63efa523325b256a875cf7801181115f0ca38a50cdc211cc45b

Comments