MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d6d509c4fd6524e141fba643d875a828fe929d8799472e2f9dbb7b6fb1e696e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d6d509c4fd6524e141fba643d875a828fe929d8799472e2f9dbb7b6fb1e696e
SHA3-384 hash: c78398149bd91e661116f9a421e220d59fcbe185713906b344347af32cf958f0d698013a6d00f44ecb2f90a87b2353f7
SHA1 hash: b614adc7d4fe14f3fbe54e2628392c14dec92717
MD5 hash: a97caacb22dadc792c447405af49322d
humanhash: bluebird-quiet-vegan-september
File name:AWB - INVOICE SHIPPING DOCUMENTS.gz
Download: download sample
Signature Loki
Create hunting rule
File size:461'466 bytes
First seen:2020-11-06 07:03:22 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:g3lMsRSwgsyzHdVg9gfpMq232RdbIuQfMCH+7aE9:gCstM7kPROdbIaChE9
TLSH DFA42312784CAC94B851EB24637D6A006211E8C3AE5819FEB3CED336F41ED949DFE365
Reporter abuse_ch
Tags:DHL gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: ns12.iraq-dns.com
Sending IP: 185.52.101.73
From: DHL EXPRESS SHIPPING. <info@noc.oil.gov.iq>
Reply-To: georginabaker47@gmail.com
Subject: AWB: Invoice & Shipping Documents ready for pick-up
Attachment: AWB - INVOICE SHIPPING DOCUMENTS.gz (contains "AWB - INVOICE SHIPPING DOCUMENTS.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.35090923.19640.17961.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3d6d509c4fd6524e141fba643d875a828fe929d8799472e2f9dbb7b6fb1e696e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-05 04:27:23 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hvwvbhcp2zje4fa7xjsd3b22qkh6skoypgkhfyxz3o33n6y6nfxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 3d6d509c4fd6524e141fba643d875a828fe929d8799472e2f9dbb7b6fb1e696e

(this sample)

Loki

Executable exe d344dbd1534297c5a51142faeb7911acd917232e2e52e61025986ced998c8aa1

  
Dropping
MD5 9546acbf69035f98825e848f5af962b8
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d344dbd1534297c5a51142faeb7911acd917232e2e52e61025986ced998c8aa1

Comments