MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eaed986834f2f7b38f8833c11b28be16c4354897f4748c55e16a3a3642ef2187. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eaed986834f2f7b38f8833c11b28be16c4354897f4748c55e16a3a3642ef2187
SHA3-384 hash: 901f85b5f60abfba92b019f227953d25ef99fcff667db6afe515859ac4c3b3461d8472b0b0f04bbe53d6fd00a1add34d
SHA1 hash: ac94b4315d59f6f6b1bafc3e48d7b403708028f0
MD5 hash: 9e6e3b98bd0faec90a5c848c31d1178d
humanhash: lake-jupiter-lemon-mirror
File name:New Purchase Order.001
Download: download sample
Signature Loki
Create hunting rule
File size:360'750 bytes
First seen:2020-08-11 11:50:23 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:SKgyuIV4V26ksV0H44YNOX51WhngunYgF0Qu3O4bHiLOAerYG72e/a096KzUk0Sp:puIV4V2GVO44AQAhInHbzdV/a09I3y+u
TLSH 157423EFC6DE40AB2448819D042AA1D78523BB5B4F5DCA022FAF5E091B7D1FFE194067
Reporter abuse_ch
Tags:001 Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mxserver2.masterweb.com
Sending IP: 103.25.223.22
From: wp@indo-heavy.com
Subject: Fwd: TOP Urgent new Purchase Order fcl 20'HOC0039119
Attachment: New Purchase Order.001 (contains "New Purchase Order.exe")

Loki C2:
http://naturepack.cc/amadi/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eaed986834f2f7b38f8833c11b28be16c4354897f4748c55e16a3a3642ef2187/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-11 11:51:09 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5lwzq2bu6l33hd4igparwkf6c3cdksex6r2iyvpbni5dmqxpegdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/eaed986834f2f7b38f8833c11b28be16c4354897f4748c55e16a3a3642ef2187

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar eaed986834f2f7b38f8833c11b28be16c4354897f4748c55e16a3a3642ef2187

(this sample)

Loki

Executable exe 722521ac19cd30a318eb191975eecadb389fe26c681d76f1c5da92dc8fabac4f

  
Dropping
MD5 5de894235f356b9017d27715efe8bb05
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 722521ac19cd30a318eb191975eecadb389fe26c681d76f1c5da92dc8fabac4f

Comments