MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31ffec142c1a204bb33edb1c9610e2de57da7c9c1dfc74756216ffd93fcbe5d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31ffec142c1a204bb33edb1c9610e2de57da7c9c1dfc74756216ffd93fcbe5d5
SHA3-384 hash: 65ddf11eafa42f5872620b229f18646a813c174c84300d5c1b5fff74283e4da61f7ee80ec47f142b1ea98218f599eefe
SHA1 hash: bc9c5c55e29953e5068eab0e1e1d6f0530029383
MD5 hash: ed3262f26bede07125d9c6422e78b2f9
humanhash: johnny-virginia-mississippi-music
File name:56782234-DHL-AWB-2021.rar
Download: download sample
Signature Loki
Create hunting rule
File size:388'307 bytes
First seen:2021-01-18 08:19:42 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:uRJbT5OSjZ8XCSHHyUH8l1IH0BSacxkaOQF3MEBp1bvXcgiSOqGaVvquTN3WZnLR:uRJZhZ8SSHHW1IHekB2svZRNTtc1H
TLSH F18423B57C185574B506D2ACED9B2B0B2EA2138F6C0DA5703A304FE21F649C5FEC7166
Reporter abuse_ch
Tags:DHL rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vps.doctorpc.pe
Sending IP: 198.38.91.247
From: Purchase@kancelaria-tw.pl
Subject: DHL-Team
Attachment: 56782234-DHL-AWB-2021.rar (contains "56782234-DHL-AWB-2021.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/31ffec142c1a204bb33edb1c9610e2de57da7c9c1dfc74756216ffd93fcbe5d5/
Threat name:
ByteCode-MSIL.Trojan.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2021-01-18 08:16:01 UTC
AV detection:
9 of 45 (20.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gh76yfbmdiqexmz63mojmehc3zl5u7e4dx6hi5lcc375sp6l4xkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/31ffec142c1a204bb33edb1c9610e2de57da7c9c1dfc74756216ffd93fcbe5d5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 31ffec142c1a204bb33edb1c9610e2de57da7c9c1dfc74756216ffd93fcbe5d5

(this sample)

Loki

Executable exe 82047917ba8c25313b170f2dc6d74f3aacfd31745d054e5f865e468dcd3b5298

  
Dropping
MD5 0729423a4ec986dabf905f07a39f8d2c
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 82047917ba8c25313b170f2dc6d74f3aacfd31745d054e5f865e468dcd3b5298

Comments