MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b09c3521cc32ab8d8a523e9c784818d722a514b09f253c552ce8a77ef7fbcd8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b09c3521cc32ab8d8a523e9c784818d722a514b09f253c552ce8a77ef7fbcd8
SHA3-384 hash: 3b73b92b676b48b73f8bebe11c5552117c27201080f1b41d8e503de1b3c3a3fd234f5a5ddac3b6457fce3d292750a35e
SHA1 hash: 308d35c3b90a2106c72f367855bac49cf8ca39e7
MD5 hash: b129103770094fdf217207d21e2e455b
humanhash: zebra-wisconsin-dakota-muppet
File name:DHL SHIPPING DOCUMENT CI PACKING LIST_PDF.gz
Download: download sample
Signature Loki
Create hunting rule
File size:192'799 bytes
First seen:2020-06-24 05:49:24 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 3072:EyN5CvN64oZbMr1e3SZAm66PdPCQI6ItxiXNR9oACoS8mSCFQs:EOACMrQpmjVPCc6ANR9/CoS8mSCFQs
TLSH 731412B64F1265A71FFA5AB036163D49DC0FBD4CB8A4990470DB3243DD473BA29BE4A0
Reporter abuse_ch
Tags:DHL gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: cp432.agava.net
Sending IP: 80.78.250.147
From: DHL Global Mail Inc © <bdcare@dhl.com>
Reply-To: Costomer service <ricknicolas.aol@hotmail.com>
Subject: DHL Shipment Notification Ref ID: 44633179800
Attachment: DHL SHIPPING DOCUMENT CI PACKING LIST_PDF.gz (contains "gunzipped")

Loki C2:
http://zoldpasszus.hu/bb/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2b09c3521cc32ab8d8a523e9c784818d722a514b09f253c552ce8a77ef7fbcd8/
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-06-24 05:51:04 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fme4guq4ymvlrwffepu4pbebrvzcuuklbhzfhrksz2fhp337xtma._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 2b09c3521cc32ab8d8a523e9c784818d722a514b09f253c552ce8a77ef7fbcd8

(this sample)

Loki

Executable exe 3493adb86f0da3a09e5eea6a97f8490a7718158742d29c4f14aca8ce30c4aeaf

  
Dropping
MD5 2ae92b3fc0cd3dc9c4df703a4a15e15a
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3493adb86f0da3a09e5eea6a97f8490a7718158742d29c4f14aca8ce30c4aeaf

Comments