MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b73c70f22409872fd63e92e13d83da1bd27a11b2e1acfb2272034fcdbbefa1a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b73c70f22409872fd63e92e13d83da1bd27a11b2e1acfb2272034fcdbbefa1a
SHA3-384 hash: 1afa22c460ba508f014742dc367264b9805d14b75bcda24eadb9f950b8bf082d8098aa141fe1f673c5ce1067eb11ee43
SHA1 hash: 97ba61995f5ac529182f4fce50d6348f0f83f95c
MD5 hash: 49e71f8db9685995e879c1aaeabcc3b3
humanhash: leopard-autumn-jersey-florida
File name:Shipping Document....PLCI_PDF.gz
Download: download sample
Signature Loki
Create hunting rule
File size:575'442 bytes
First seen:2020-05-07 12:17:00 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:AEl/f9dzYs2yGF6vkSQ+HlH7rKEhsaRVgg3OSLbYpQ58iUBhQr2PmI3Zl:ll/f9dzFrPL7rK1aRxey0pQ5coqpl
TLSH 2BC4238F5E007BFED66A68D98AA313F323E4D94CD7B30DB5D92E56481684D303B0696C
Reporter abuse_ch
Tags:DHL gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

Sending IP: 137.59.13.130
From: DHL EXPRESS <risal@mks.cross.net.id>
Reply-To: DHL Service <ricknicolas.aol@hotmail.com>, DHL Service <ricknicolas.aol@hotmail.com>
Reply-To: DHL Service <ricknicolas.aol@hotmail.com>, DHL Service <ricknicolas.aol@hotmail.com>
Subject: DHL Shipment Notification Ref ID: 44633179800
Attachment: Shipping Document....PLCI_PDF.gz (contains "gunzipped")

Loki C2:
http://missingandfound.com.my/bb/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Adware.Generic4.BBFB.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Webalta-6862190-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 12:36:28 UTC
File Type:
Binary (Archive)
Extracted files:
61
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jnz4odzcicmhf7ld5exbhwb5ug6spii3fynm7mrhea2pzw567ina._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 4b73c70f22409872fd63e92e13d83da1bd27a11b2e1acfb2272034fcdbbefa1a

(this sample)

Loki

Executable exe 640b8fb7d9f4d83299a5b00069886616bf90d5e77e6007ee40ab2cd0f2f0f410

  
Dropping
MD5 a9fe06c7a629fff217cdb43dd19099d9
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 640b8fb7d9f4d83299a5b00069886616bf90d5e77e6007ee40ab2cd0f2f0f410

Comments