MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e191591f982ae607a2fb08f6caddfc6fe215af00477927e8c07186e766ea9015. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e191591f982ae607a2fb08f6caddfc6fe215af00477927e8c07186e766ea9015
SHA3-384 hash: ff9e52805fc365282e0af403c5436fab848f50fcec0d637f5f7f2d928d1d768b988fd77a9db1ee8aa4da8e301d578ddd
SHA1 hash: 061510f24f315917418b00e4e2f29aa82f4c51a1
MD5 hash: 5f3daf9ee81743ecb468b181d3a84018
humanhash: ink-cat-oven-tango
File name:Documentos de pago.img
Download: download sample
Signature Loki
Create hunting rule
File size:1'376'256 bytes
First seen:2021-01-13 07:29:41 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:SoQfz9FCeOsG6MDE3JWukxRgDlmU5PprO+ECAKEzdQvBd72pgrGns14oJIT:lQfzYBDg8uR5mU5PN9bECs
TLSH 8E557E98BB81B34DC79E88FE55441C70AA90D27663DFE316D0076079AF4E4698EFD0E2
Reporter abuse_ch
Tags:img Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: v464981.neubox.net
Sending IP: 65.99.248.172
From: A&N Forwarding, INC. <facturacion@anforwarding.com>
Subject: Aviso de pago - Ref. Aviso[G1117599144] / Pago prioritario
Attachment: Documentos de pago.img (contains "Documentos de pago.PDF.bat")

Loki C2:
http://51.195.53.221/p.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
138
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.36094996.4864.28551.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e191591f982ae607a2fb08f6caddfc6fe215af00477927e8c07186e766ea9015/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-12 22:14:42 UTC
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4givsh4yfltapix3bd3mvxp4n7rbllyai54sp2gaogdoozxksakq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e191591f982ae607a2fb08f6caddfc6fe215af00477927e8c07186e766ea9015

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

img e191591f982ae607a2fb08f6caddfc6fe215af00477927e8c07186e766ea9015

(this sample)

Loki

Executable exe a34d721f2e55cfaf7913b4a5805cc1be6becb6f4bb61875b8d7f7d60c23b3e29

  
Dropping
MD5 3f09920e886cc97941e5f583df1f748e
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a34d721f2e55cfaf7913b4a5805cc1be6becb6f4bb61875b8d7f7d60c23b3e29

Comments