MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 222edac1aa090920f2bbc6aac50d561a64b41b3e29c6070a5527a4c4e20e73d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 222edac1aa090920f2bbc6aac50d561a64b41b3e29c6070a5527a4c4e20e73d3
SHA3-384 hash: 4fcd410fc609180b40495ae1c937f47d5fc31b1e1ee73df063f3bee68a42ba299e921a9aeb61ef7468d139abdf32ab29
SHA1 hash: 6b4a4846f6aeb3324e89a851c29155ac257ac218
MD5 hash: 330df1cdcfebec2bb368b6046433ee45
humanhash: nitrogen-october-blossom-hot
File name:KMBT 18-06-2020 Air Waybill-Receipt no AWB 140825003078 INDONESIA TBK Need PIB documentations-pdf.
Download: download sample
Signature Loki
Create hunting rule
File size:459'750 bytes
First seen:2020-06-25 09:21:54 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:Zk4NXxMI/BFX/gxd3ba6sric+OeZ4Xd92SUOI6qL:e4Fxlx/gDpcIj4y1O6L
TLSH 86A42369BBFA8C715C669BBBD44A04C107C9E1FC25827485D836F48ADED6120E7B380E
Reporter abuse_ch
Tags:DHL Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: flashmails.webmail.co.id
Sending IP: 111.68.113.28
From: Formal Delivery Clearance Support (DHL ID) <sales@kenkosahabat.id>
Subject: DHL Notification of Arrival (Electronic Generated Invoice) - AWB# 140825003078 // INDONESIA TBK : Need PIB documentations
Attachment: KMBT 18-06-2020 Air Waybill-Receipt no AWB 140825003078 INDONESIA TBK Need PIB documentations-pdf. (contains "gunzipped")

Loki C2:
http://airmanselectiontest.com/dest/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

PUA.Win.Adware.Webalta-6862190-0
Create hunting rule

SecuriteInfo.com.Win32.Herz.B.10803.7096.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/222edac1aa090920f2bbc6aac50d561a64b41b3e29c6070a5527a4c4e20e73d3/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eixnvqnkbeesb4v3y2vmkdkwdjsligz6fhdaocsve6smjyqoopjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 222edac1aa090920f2bbc6aac50d561a64b41b3e29c6070a5527a4c4e20e73d3

(this sample)

Loki

Executable exe 77110690443258661b1d83aa50ca329cf660e484a5c74e80930e2b42bc9d6b50

  
Dropping
MD5 31610b09e4cf2b47e76290d4df4b4260
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 77110690443258661b1d83aa50ca329cf660e484a5c74e80930e2b42bc9d6b50

Comments