MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b575d31e98e6bd4cff692cc148b0ec79090d2b89ee63913ecd8c4f58ec1fd10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b575d31e98e6bd4cff692cc148b0ec79090d2b89ee63913ecd8c4f58ec1fd10
SHA3-384 hash: 8885b79dfb7db80bc87187d35ff875d9b882360e3433d91678aa7464202e658a53f811292a75d03873f99ec9b6d047a1
SHA1 hash: e68eb83982f88b35f038473c26cef33f1b3248ba
MD5 hash: bbf7290d152e7810630412cf820f2856
humanhash: neptune-delaware-east-oregon
File name:Shipping Document PLCI_PDF.gz
Download: download sample
Signature Loki
Create hunting rule
File size:366'949 bytes
First seen:2020-05-04 18:12:04 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:DJo/hg75R8E1r9wZSc1cqQIM/UOHNhsyDIEtM/WLQc2oUT+CB0h:lOgFrZfO3wX7ss/tMuZUap
TLSH 997423DB603290653F6A73A4C9A29C0CF46D89F83A413B77D954E099406ADED3B1F339
Reporter abuse_ch
Tags:DHL gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: cross.net.id
Sending IP: 137.59.13.130
From: DHL EXPRESS <risal@mks.cross.net.id>
Reply-To: DHL Service <ricknicolas.aol@hotmail.com>, DHL Service <ricknicolas.aol@hotmail.com>
Subject: DHL Shipment Notification Ref ID: 44633179800
Attachment: Shipping Document PLCI_PDF.gz (contains "gunzipped")

Loki C2:
http://missingandfound.com.my/pull/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 12:54:44 UTC
File Type:
Binary (Archive)
Extracted files:
61
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pnlv2mpjrzv5jt7wslgbjcyoy6ijbuvyt3tdse7m3dcpldwb7uia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 7b575d31e98e6bd4cff692cc148b0ec79090d2b89ee63913ecd8c4f58ec1fd10

(this sample)

Loki

Executable exe 3d91f9a7e6b4035a5c69f403b529dd1a398e4f05316e7ad9ddeeaaf624c471f5

  
Dropping
MD5 fa35fc00e2bbf1fd441fd12811fe5d10
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3d91f9a7e6b4035a5c69f403b529dd1a398e4f05316e7ad9ddeeaaf624c471f5

Comments