MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4e49728e232694ecd86f97e0ce42ec4b1f9db823ccf072a1790a501be42e2f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e4e49728e232694ecd86f97e0ce42ec4b1f9db823ccf072a1790a501be42e2f5
SHA3-384 hash: 58c10412ffb854a976913eb421f6e24070a08763bad954136949a01e0bf70004ed5a63ca107fbe7a76968677ec2cbc0f
SHA1 hash: a76670df0edb1b22e29f69715602e7b510f8db0e
MD5 hash: 85be123cf9f65704b0d529ee0f504c52
humanhash: fix-solar-south-six
File name:NEW ORDERs 01012020.zip
Download: download sample
Signature Loki
Create hunting rule
File size:382'405 bytes
First seen:2021-03-09 15:27:40 UTC
Last seen:2021-03-12 15:17:37 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:j3eltV+zBsNub6aL+nf+r0Y+rqj6gBi2WfT2BJBpXsx4X2st6ELmnPzfuKdWay:jECsNub6GIf+r0Y5jrM4vpX2A6LPzfV0
TLSH 128423797360882FDF03405A3B24960A0F6FC66DC497276AC02DE428A9EF3A7551DDE7
Reporter GovCERT_CH
Tags:Loki

Intelligence

File Origin
# of uploads :
3
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.36476215.13678.1157.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 10:58:16 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4tsjokhcgjuu5tmg7f7azzboysy7tw4chthqokqxscsqdpsc4l2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/e4e49728e232694ecd86f97e0ce42ec4b1f9db823ccf072a1790a501be42e2f5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip e4e49728e232694ecd86f97e0ce42ec4b1f9db823ccf072a1790a501be42e2f5

(this sample)

Loki

Executable exe d6890849e091421ce29c085e43fea6dc287462acee095269f79b201343929a28

  
Dropped by
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d6890849e091421ce29c085e43fea6dc287462acee095269f79b201343929a28
  
Dropping
MD5 afc5c29901d6365fc3e97da220222b30

Comments