MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd264ee097082f51c9825408abdfad1df0def6d538b838fd9eca200b505ab4dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd264ee097082f51c9825408abdfad1df0def6d538b838fd9eca200b505ab4dd
SHA3-384 hash: bb7244564a2ff6dccc50108888b2d78e971fa0291755e4cc7a9109c7e931af7654c561a1a88d7c8dc9e4e4c8c3a929db
SHA1 hash: 8d2e12fc0c78dbe826069703dfd1eb71b39534e5
MD5 hash: 712042c481ca4c609f416692b06615df
humanhash: one-stairway-fix-burger
File name:INVOICE COPY.pdf.z
Download: download sample
Signature Loki
Create hunting rule
File size:486'584 bytes
First seen:2020-08-31 05:58:44 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:YPi3MGxgcKXarRdqvheSIYu/TIi+ZKpn6hPh7ujqv:YPi3v+or2e/TITZNPhKjqv
TLSH D5A42301662E71528247BFBF0461370A36154F60D966C8EDFABB0E7B7A219B6A5F4031
Reporter abuse_ch
Tags:Loki z


Avatar
abuse_ch
Malspam distributing Loki:

HELO: alkuhaimi.com
Sending IP: 37.48.85.226
From: Financial Manager <rud-division@alkuhaimi.com>
Subject: FW: 回复: paid invoice
Attachment: INVOICE COPY.pdf.z (contains "INVOICE COPY.pdf.exe")

Loki C2:
http://reiangkor.com/admin/themes/css/light/admin/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd264ee097082f51c9825408abdfad1df0def6d538b838fd9eca200b505ab4dd/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-08-30 20:32:58 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zute5yexbaxvdsmckqekxx5ndxyn55wvhc4dr7m6ziqawuc2wtoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cd264ee097082f51c9825408abdfad1df0def6d538b838fd9eca200b505ab4dd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z cd264ee097082f51c9825408abdfad1df0def6d538b838fd9eca200b505ab4dd

(this sample)

Loki

Executable exe d629c8de27a6f2c0315cb88b5cf940d5f67c63177fba59adf564c689dcff7fd1

  
Dropping
MD5 08683eac1c665ffdf53e6706a9dccdb5
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d629c8de27a6f2c0315cb88b5cf940d5f67c63177fba59adf564c689dcff7fd1

Comments