MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 635dbe0bca9fd370cf86d4f71163e4ed0c34692801046d30364650e92cbe6659. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 4 Yara Comments

SHA256 hash: 635dbe0bca9fd370cf86d4f71163e4ed0c34692801046d30364650e92cbe6659
SHA3-384 hash: 734ea7517515c1d91227f48804af80fae399dd82eea070cbf9a62b70b55d2a7818433ee12959b98ee1bdf99a3a55b092
SHA1 hash: b432785abf7db0ac3f301da72718ab8fbc002958
MD5 hash: 07a38f37f716b6b1f02bb1d0c7a8f7b9
humanhash: louisiana-bakerloo-carolina-indigo
File name:SHIPPING_DOCS_WAN_HAI_pdf.arj
Download: download sample
Signature Loki
File size:196'483 bytes
First seen:2020-06-30 06:24:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:NqABvP4+LjK3BXAHLv/uxEZpzmV+PEeapCSfvI5gHgIUyOmg3gekRuxhglgnMbkb:NqqH76qL4gm8PEeapBvGgHQyfeCw0AGa
TLSH E7142323CC82CEBE7167E3D7D4DDC396EDA76C98876F3882344BA904DD115A60671066
Reporter @abuse_ch
Tags:arj Loki


Twitter
@abuse_ch
Malspam distributing Loki:

HELO: bce.idm.net.lb
Sending IP: 194.126.4.60
From: exp315@tpe.kingonward.com
Subject: RE: SHIPPING DOCS FOR WAN HAI 305 V-S226 (HOCHIMINH) FCL shipment -- WHL SVC
Attachment: SHIPPING_DOCS_WAN_HAI_pdf.arj (contains "SHIPPING_DOCS_WAN_HAI_pdf.exe")

Loki C2:
http://flexpak-th.com/osama/aboki/fre.php

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 31
Origin country US US
ClamAV SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
CERT.PL MWDB Detection:n/a
Link: https://mwdb.cert.pl/sample/635dbe0bca9fd370cf86d4f71163e4ed0c34692801046d30364650e92cbe6659/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Kryptik
First seen:2020-06-30 06:26:04 UTC
AV detection:17 of 48 (35.42%)
Threat level:   5/5
Spamhaus Hash Blocklist :Malicious file
VirusTotal:Virustotal results 30.30%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 635dbe0bca9fd370cf86d4f71163e4ed0c34692801046d30364650e92cbe6659

(this sample)

  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment

Comments