MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96376f17952a5fef52ae30e606e71e6dcd56b8b26a2264d9b2f558acfac0a897. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96376f17952a5fef52ae30e606e71e6dcd56b8b26a2264d9b2f558acfac0a897
SHA3-384 hash: c20811258d2eca1425b5f1725d4aac135314d442e2721c5cd0e05269cdc3b4b9a5982216d5459a109b417bf30ce28321
SHA1 hash: c253cf56bdb2015586da1dc4e256044608b3dbd8
MD5 hash: 04d616255b7a902826d129fdf3effc49
humanhash: summer-red-indigo-queen
File name:Shipping Document PLCI_PDF.gz
Download: download sample
Signature Loki
Create hunting rule
File size:436'682 bytes
First seen:2020-04-30 09:42:35 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:WxrUtPq+6XBWqeyef9MfQ+RrgKwgABdB+iZx2+GAuPOUVq4Qyc:WxrcPq+6X0WkMfXwgGdB+28O3yc
TLSH 039423654A945CF427CD6B72CEF688001EE0FDB48EEE1C7AD795CF4C09A148165EB68C
Reporter abuse_ch
Tags:DHL gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: cross.net.id
Sending IP: 137.59.13.130
From: DHL EXPRESS <risal@mks.cross.net.id>
Reply-To: DHL Service <ricknicolas.aol@hotmail.com>
Subject: DHL Shipment Notification Ref ID: 44633179800
Attachment: Shipping Document PLCI_PDF.gz (contains "gunzipped")

Loki C2:
http://missingandfound.com.my/pull/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 04:30:14 UTC
File Type:
Binary (Archive)
Extracted files:
39
AV detection:
30 of 48 (62.50%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sy3w6f4vfjp66uvogdtanzy6nxgvnofsnirgjwns6vmkz6wavclq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 96376f17952a5fef52ae30e606e71e6dcd56b8b26a2264d9b2f558acfac0a897

(this sample)

Loki

Executable exe d2413a8b2b2056da1f4855318e34e285e1f91d2824c41125eb9daf6b5fb6584b

  
Dropping
MD5 ad8b13b72aba65624f2b109e5327ec95
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d2413a8b2b2056da1f4855318e34e285e1f91d2824c41125eb9daf6b5fb6584b

Comments