MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4f2be562159fcc648f7806910c53c2487bfb985d32963000121570fabec02d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f4f2be562159fcc648f7806910c53c2487bfb985d32963000121570fabec02d0
SHA3-384 hash: 27566f99cf2f8157bf8d7a3bb87ff28598258d646005d4f7ca6bab58f21a6692c5135b39a9ba4e78c3e1b7ee703e3a5a
SHA1 hash: 55c8acc23cb46af670d02edfc4a2b34fffe3b3d8
MD5 hash: c1040e2da6bc0b210159677ecbcb4119
humanhash: paris-nine-nitrogen-victor
File name:RT-05723.zip
Download: download sample
Signature Loki
Create hunting rule
File size:463'858 bytes
First seen:2021-01-12 07:21:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:9fgD7XgHFO4dfk56GRNfUXUwFQIcr6KRxRE5TLwff1BbdnyehTOM5+l/IN1/Bc8t:9fEgH1d6Rr6yuLw1TMl/IN1xt
TLSH 63A423A0A09BC9FCDA15BBF5DC619F2981C3CCE1101DC3954F0B566EDEC66C94A29F28
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: metadrill.net
Sending IP: 199.43.204.181
From: Paul Chakthoura <ashakhtura@metadrill.net >
Subject: Fwd: Reversed document order
Attachment: RT-05723.zip (contains "RT-05723.bat")

Intelligence

File Origin
# of uploads :
1
# of downloads :
155
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f4f2be562159fcc648f7806910c53c2487bfb985d32963000121570fabec02d0/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-12 07:22:15 UTC
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6tzl4vrblh6mmshxqburbrj4esd37omf2muwgaabeflq7k7malia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f4f2be562159fcc648f7806910c53c2487bfb985d32963000121570fabec02d0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip f4f2be562159fcc648f7806910c53c2487bfb985d32963000121570fabec02d0

(this sample)

Loki

Executable exe 2107a31669bfe0b3bbb80e1f2853015aff987ad14aa23e7583cedeefe49aa775

  
Dropping
MD5 bfe10e132575e8fcbd2fea56ab4effc5
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2107a31669bfe0b3bbb80e1f2853015aff987ad14aa23e7583cedeefe49aa775

Comments