MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10f6f82510b9cb8818fb53c79ccef38135d84dc8165cceb318ac7f8166375590. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10f6f82510b9cb8818fb53c79ccef38135d84dc8165cceb318ac7f8166375590
SHA3-384 hash: a8392870a0c61e190e635eae61865a482f5bfd613d6634a5e739f4ed47084f46f83b2f36836e345a02b40373d3f3d46a
SHA1 hash: c345908b0c75891e2bc4176f093d9654cdc391f3
MD5 hash: 2043e6773502c843fba7ea6047c95643
humanhash: speaker-grey-hotel-thirteen
File name:Walmart Purchase Orders W9472057_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:335'322 bytes
First seen:2020-08-11 12:53:18 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:crLPzchbh5n3m013vOQZwpnQUJJCGiPyP3udo8qrbzlIEI/3L0vDflxL2ZWXM:Urz+bnWfQEePymK8kM3gviIM
TLSH AE6423E6A596EB0836D58FED638A1E0C55EF34FCC4E9AB614C041ECE5387D9E09019B3
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: dciplesk45.dotcom.id
Sending IP: 103.89.6.45
From: Greg Smith <admin@cadament.com>
Subject: Walmart Purchase Orders W9472057 - Urgently
Attachment: Walmart Purchase Orders W9472057_pdf.gz (contains "Walmart Purchase Orders W9472057_pdf.exe")

Loki C2:
http://buildbd.org/css/csss/Panel/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/10f6f82510b9cb8818fb53c79ccef38135d84dc8165cceb318ac7f8166375590/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-11 12:55:04 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cd3pqjiqxhfyqgh3kpdzztxtqe25qtoiczom5myyvr7yczrxkwia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/10f6f82510b9cb8818fb53c79ccef38135d84dc8165cceb318ac7f8166375590

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 10f6f82510b9cb8818fb53c79ccef38135d84dc8165cceb318ac7f8166375590

(this sample)

Loki

Executable exe d2cee19a1e56d95d538becd56933a02727bb4df3e07ed9a476fb5776003361b6

  
Dropping
MD5 25b667cd901f222c865a3e009bf8c7ac
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d2cee19a1e56d95d538becd56933a02727bb4df3e07ed9a476fb5776003361b6

Comments