MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ec747ff2966f2a067f9917f39bf0adc04522457abcf19cad2d1cb938ff8c89b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Loki
Vendor detections: 6
| SHA256 hash: | ec747ff2966f2a067f9917f39bf0adc04522457abcf19cad2d1cb938ff8c89b9 |
|---|---|
| SHA3-384 hash: | 42e2ce4a5c645aa66fc67c3bed868a58196087e45e86a44bb4335717555db7b0bbdcdad999536bccf1fcea1592a9b8e1 |
| SHA1 hash: | 0782a1c04a44d5df63c2c4b800118b44da7cb617 |
| MD5 hash: | 8767f3717f33e3031976eac0720061fc |
| humanhash: | saturn-alpha-ceiling-whiskey |
| File name: | Proforma invoice for order-PO 2108137 R1.r00 |
| Download: | download sample |
| Signature | Loki |
| File size: | 481'008 bytes |
| First seen: | 2021-11-25 06:32:13 UTC |
| Last seen: | 2021-11-25 13:08:35 UTC |
| File type: | r00 |
| MIME type: | application/x-rar |
| ssdeep | 12288:EAjeyYwET8z0TPjkuJk4JOmW/Qy6zsFUpoyC1awk8AV:EAayzET8YPkuemoMyzAwyV |
| TLSH | T102A42310272B66D0D85DE178F51A1B9E527FA5A10BB651F05CD2B80F8BE1EC6F1BE08C |
| Reporter |  cocaman |
| Tags: | INVOICE Loki r00 |
cocaman
Malicious email (T1566.001)From: "Angela wu <stampa@novapri.com>" (likely spoofed)
Received: "from novapri.com (unknown [103.145.252.28]) "
Date: "25 Nov 2021 03:56:01 -0800"
Subject: "RE Proforma invoice for order-PO 2108137 R1"
Attachment: "Proforma invoice for order-PO 2108137 R1.r00"
Intelligence
File Origin
# of uploads :
3
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
obfuscated packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
ByteCode-MSIL.Trojan.LokiBot
Status:
Malicious
First seen:
2021-11-25 06:33:15 UTC
File Type:
Binary (Archive)
Extracted files:
68
AV detection:
25 of 45 (55.56%)
Threat level:
5/5
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Dropping
Loki
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.