MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9cfd3c3599b22f156493670236471855cd50de3fac9d678a08642eb83cd82969. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9cfd3c3599b22f156493670236471855cd50de3fac9d678a08642eb83cd82969
SHA3-384 hash: 5a3ca35aa4f473bef6eba3c2809868903c926846d77144521725b14fc93c58165d9fd05bdab1db406d3085314d213ba0
SHA1 hash: 6178a10623f4dc224253b5f37659b8f52e074b16
MD5 hash: 8d67890b6ed524e70fa515a289dc6ceb
humanhash: lima-pennsylvania-nuts-hot
File name:MSC SHIPMENT.gz
Download: download sample
Signature Loki
Create hunting rule
File size:245'425 bytes
First seen:2020-08-18 13:01:35 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:TCcdcDBFvbg+aKzAneLsbTeiP6OSYV4aPJFmep0:ec8vbgXFeLiP6SKaSeC
TLSH 583423840C50A99DE3A65526F8E9590D326F1328F28F5692C5232ADFEDB43C1B61FF08
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.ptjlg.co.id
Sending IP: 103.253.68.52
From: Rehan Ishaque MSC Pakistan <finance@ptjlg.co.id>
Subject: RE: BL DRAFT COPY FOR CURRENT MSC SHIPMENT
Attachment: MSC SHIPMENT.gz (contains "gunzipped")

Loki C2:
http://easydriverservice.com/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9cfd3c3599b22f156493670236471855cd50de3fac9d678a08642eb83cd82969/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tt6tynmzwixrkzetm4bdmryykxgvbxr7vsowpcqimqxlqpgyffuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9cfd3c3599b22f156493670236471855cd50de3fac9d678a08642eb83cd82969

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 9cfd3c3599b22f156493670236471855cd50de3fac9d678a08642eb83cd82969

(this sample)

Loki

Executable exe 677eca0f74afb71debcf21e53261c6bd8adf27d2fd8ac99e0a5e9e7b2231f5fb

  
Dropping
MD5 b3d7af042fd2aa52f47ca9ea2abe166c
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 677eca0f74afb71debcf21e53261c6bd8adf27d2fd8ac99e0a5e9e7b2231f5fb

Comments