MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eca356b9d04b47636e92e696eebdc4d38ab2207641608a0b1a1af4d957a20f14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eca356b9d04b47636e92e696eebdc4d38ab2207641608a0b1a1af4d957a20f14
SHA3-384 hash: 58c70af59716e88157245d6df00f867e7595017d823b6f9656d1f163e66179a26b3a1d636a50e45e929b685eb0177aeb
SHA1 hash: 7f02aacd2830c00df3432200f1558a6a0958cba8
MD5 hash: 514da573538e257e5730b87849833f47
humanhash: carbon-six-solar-seventeen
File name:INVOICES.gz
Download: download sample
Signature Loki
Create hunting rule
File size:783'482 bytes
First seen:2020-07-06 08:22:21 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:869TjnZsdCW32gd2mvyO/jqtPppEkwE4Y44vfUfeA0aOc+yq5CSO1qnaOqpMz:ZFmdC8d2m9LqtPjPwEA4v6GvCSCMz
TLSH 45F433CC69FC5B64AB60273AEF85FA9A5D4981575C364E0C20CA7030AF361E04BD67DB
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: n3.syzefxis.gov.gr
Sending IP: 95.211.208.25
From: Faiyaz Sayyed <dke.t.perivalontos@n3.syzefxis.gov.gr>
Subject: RE: R-131 INVOICES
Attachment: INVOICES.gz (contains "INVOICES.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eca356b9d04b47636e92e696eebdc4d38ab2207641608a0b1a1af4d957a20f14/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 08:24:06 UTC
AV detection:
31 of 48 (64.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5srvnooqjndwg3us42lo5poe2ofleidwifqiucy2dl2nsv5cb4ka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz eca356b9d04b47636e92e696eebdc4d38ab2207641608a0b1a1af4d957a20f14

(this sample)

Loki

Executable exe 7d8fc608e438fa407e73ad8e18d0978e83afb07894dddac811385d317c106336

  
Dropping
MD5 59fb38ca9000d5553a9d1ddf9015eb40
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7d8fc608e438fa407e73ad8e18d0978e83afb07894dddac811385d317c106336

Comments