MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b951943b6f9992c00dfb124e76a5ca2badf7c626df9d14f9c3a2ded79c9f45a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b951943b6f9992c00dfb124e76a5ca2badf7c626df9d14f9c3a2ded79c9f45a2
SHA3-384 hash: 0d57f587019f26614ec9d1cff91c8299dfa884c317c43732bfd4d4ab7811f2025f8d341afea36902855fe2b1689d81e5
SHA1 hash: b5d4870c43add962287ba753630246d7b718b24f
MD5 hash: 3ce91c14e434cb41ae5a1f98e4324e34
humanhash: twenty-neptune-beryllium-mirror
File name:shipment airway bill_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:295'306 bytes
First seen:2020-08-10 09:27:58 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:v26Bx5HI2y/2bVOCRkHW0U14BtzJ7At981pn+emYpmQ68XWH:Z75HI32bvKrhBtzJEL81p+9YYQw
TLSH 8B54231E0E15D54EAD1BC02DE048127E64A6DD5DF36958BE19AC24ABC3273C95B823F3
Reporter abuse_ch
Tags:DHL gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: v117.auserver-hosting.com
Sending IP: 103.18.108.92
From: DHL EXPRESS <worldwide@dhl.com>
Subject: DHL Express Consignment Notification: You have A Package With Us
Attachment: shipment airway bill_pdf.gz (contains "shipment airway bill_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b951943b6f9992c00dfb124e76a5ca2badf7c626df9d14f9c3a2ded79c9f45a2/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-08-10 09:29:11 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xfizio3ptgjmadp3cjhhnjokfow7prrg36orj6odulpnphe7iwra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b951943b6f9992c00dfb124e76a5ca2badf7c626df9d14f9c3a2ded79c9f45a2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz b951943b6f9992c00dfb124e76a5ca2badf7c626df9d14f9c3a2ded79c9f45a2

(this sample)

Loki

Executable exe 926e4cc83f26d59f2af152508ead9014b678c30a8024dd1182bde49feb158fc3

  
Dropping
MD5 7ae461a26c95d7f549652f2af6eb3ae1
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 926e4cc83f26d59f2af152508ead9014b678c30a8024dd1182bde49feb158fc3

Comments