MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9da8afa2ce0b1425f0b05a43422e9869a51500b2a417e0b339e5fe3f0df60ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9da8afa2ce0b1425f0b05a43422e9869a51500b2a417e0b339e5fe3f0df60ad
SHA3-384 hash: fee63ed8d701b645578bc43743a9efd1f7447f3e2802fe977be3f35316fb8b5e0b75edb5ffe4d54f85fa42212054ca0a
SHA1 hash: aed0d93be0927d16d60549839221b32b794bb579
MD5 hash: c5a6cdb850061c9e783d47cecf7f2253
humanhash: juliet-mirror-missouri-whiskey
File name:Suho Tech-Jeongyeon Tech Order.cab
Download: download sample
Signature Loki
Create hunting rule
File size:535'219 bytes
First seen:2020-08-04 09:12:39 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:AYJGvJhUILGU0m6FkB4XdKv/J+TrA5qMaxZC4A3bl0xmMXZdrPM:rgXDLkUqcB2rxLC132VXg
TLSH 83B4231ABD4D3441E08AB3A9F7B71298EDE16B3535FB02418041396963A5FDD1ECECB2
Reporter abuse_ch
Tags:cab geo KOR Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail-smail-vm39.hanmail.net
Sending IP: 203.133.180.227
From: 주식회사 델 <ch43401@daum.net>
Subject: <주식회사 델> 7.8 발주서입니다
Attachment: Suho Tech-Jeongyeon Tech Order.cab (contains "Suho Tech-Jeongyeon Tech Order.exe")

Loki C2:
http://79.124.8.8/plesk-site-preview/krockabread.com/http/79.124.8.8/garuba/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.16980.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f9da8afa2ce0b1425f0b05a43422e9869a51500b2a417e0b339e5fe3f0df60ad/
Threat name:
Win32.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 09:14:07 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7hniv6rm4cyuexylawsdiixjq2nfcualfjax4czttzp6h4g7mcwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f9da8afa2ce0b1425f0b05a43422e9869a51500b2a417e0b339e5fe3f0df60ad

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab f9da8afa2ce0b1425f0b05a43422e9869a51500b2a417e0b339e5fe3f0df60ad

(this sample)

Loki

Executable exe ba63b256787d1c81317a6aea27399ada7bf49a452a45e3dc6245b494231b7959

  
Dropping
MD5 9f2ad63f6d1e897debe6250dcb383e07
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ba63b256787d1c81317a6aea27399ada7bf49a452a45e3dc6245b494231b7959

Comments