MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb62db1b7307cca971ebbe28c93798df5e04926729309b3e4a452ad14131d214. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb62db1b7307cca971ebbe28c93798df5e04926729309b3e4a452ad14131d214
SHA3-384 hash: 861e3347e46214c7f4ca82589ec8949e603d30f5f00ec4939e02e827ea6b1f933253f6ddc13608246018b327be7be474
SHA1 hash: 4cc0b86cb579bfca16b15d0f742e289b930f16a4
MD5 hash: 5f5844ca154e19b7b499971b46f28668
humanhash: hamper-quebec-beer-fanta
File name:Payment Copy file001_Pdf.zip
Download: download sample
Signature Loki
Create hunting rule
File size:626'380 bytes
First seen:2020-12-02 08:30:29 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:/UB0/kCJ0tzYZsl2cPUReyaHBfah6LjSn413nbqpjC/Idu:/UXk0iZsl2cMRXaEh6MobqpjC/ku
TLSH 56D423D8B7427C6A8D79DE22FAF478AF8B9DD7D7D8354F503801B8ACDA2E90440414B6
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.te-crm.net
Sending IP: 195.252.155.102
From: Citi Paylink <service@te-protection.de>
Subject: PAYMENT ADVICE REF:CITI7892R556NT
Attachment: Payment Copy file001_Pdf.zip (contains "Payment Copy file001_Pdf.exe")

Unknown payload URL:
http://nayablabs.com/pw-content/BPnKFS5PfOiBexR.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_badexts14.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eb62db1b7307cca971ebbe28c93798df5e04926729309b3e4a452ad14131d214/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-12-02 08:31:08 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5nrnwg3ta7gks4plxyumsn4y35pajethfeyjwpskiuvncqjr2ika._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eb62db1b7307cca971ebbe28c93798df5e04926729309b3e4a452ad14131d214

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip eb62db1b7307cca971ebbe28c93798df5e04926729309b3e4a452ad14131d214

(this sample)

Loki

Executable exe 13a9dd2694b5c08ac72ab0cc485ef6e607fe9b62acb966065344469155f2c55c

  
URLhaus
https://urlhaus.abuse.ch/url/882060/
  
Dropping
MD5 53482fc280d8ee50a8155b4d9b4d82ef
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 13a9dd2694b5c08ac72ab0cc485ef6e607fe9b62acb966065344469155f2c55c

Comments