MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fcf7ff62c334d9c4064fc2cd92924b90a39daf01d36b8f49ddb2775a1f7ea3cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fcf7ff62c334d9c4064fc2cd92924b90a39daf01d36b8f49ddb2775a1f7ea3cc
SHA3-384 hash: 23ae32178ec84c62c1bbad89fc075be38d13a63fc088a13caa8b00a7470451c9b1a58a001106114e2bd71a674097fe6f
SHA1 hash: 4ccc00d2e4d95238f55bbe718b743c8cff4c0033
MD5 hash: 3675be7b73af832744c74ad0b0b1517c
humanhash: london-nitrogen-video-four
File name:Document_PDF.rar
Download: download sample
Signature Loki
Create hunting rule
File size:492'042 bytes
First seen:2021-01-26 12:34:27 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Di2m2biRg/dK+3PwDNLYzIlsK5ZGh5fZ/T+2J:Di2mBRglnYDNLWgs3h5fP
TLSH E8A423792AC3FF433180B2474DDE1525BFFF2D60680FD5B949A9412346EB9DC22A3A48
Reporter cocaman
Tags:Loki rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Edward Lee / Deputy General Manager" <edward@daehwagm.co.kr>" (likely spoofed)
Received: "from th0.327.skjo.ml (unknown [46.101.132.236]) "
Date: "Mon, 25 Jan 2021 23:43:26 -0800"
Subject: "Requesting for Quotation "
Attachment: "Document_PDF.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fcf7ff62c334d9c4064fc2cd92924b90a39daf01d36b8f49ddb2775a1f7ea3cc/
Threat name:
ByteCode-MSIL.Trojan.OutBreak
Create hunting rule
Status:
Malicious
First seen:
2021-01-26 12:35:09 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7t376ywdgtm4ibspylgzfeslscrz3lyb2nvy6so5wj3vuh36upga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fcf7ff62c334d9c4064fc2cd92924b90a39daf01d36b8f49ddb2775a1f7ea3cc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar fcf7ff62c334d9c4064fc2cd92924b90a39daf01d36b8f49ddb2775a1f7ea3cc

(this sample)

Loki

Executable exe d85ede02b962372fc3f5b7cbba922080931d9cadbf1213fe107560946873d02c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d85ede02b962372fc3f5b7cbba922080931d9cadbf1213fe107560946873d02c
  
Dropping
Loki

Comments