MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a3c50f7de50bea5987cc774e807bba66995c9d96fd6b86722085cd7ec9c84ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a3c50f7de50bea5987cc774e807bba66995c9d96fd6b86722085cd7ec9c84ca
SHA3-384 hash: d891f92184e3072c5d00d0013f2742978f068e3893ebb791daba8e780855f140ec161ffbc672377fa3c355fb12678b7c
SHA1 hash: adbeda05c4f71c8cdd755ee6cea694b045ec2737
MD5 hash: c22a4bedfe6a8e83e42630641a950c25
humanhash: mountain-orange-mike-november
File name:FedEx Invoice BKK0005254282_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:414'635 bytes
First seen:2020-05-04 22:26:27 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:784nutUu6ZJnkYOgqEYFd/SfMM7dxXUaOnGu4d0Fp5yodh+pEbM1oyyCirzi1jc8:784utS7oVE9BxHOGu4d85lZMvui1YPQD
TLSH D094232FADA453A7D8612B98C8F51F9EEC6D04C8910340416A7FE1869D2CC97F20F75E
Reporter abuse_ch
Tags:FedEx gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: ip-172-31-21-154.ec2.internal
Sending IP: 54.145.164.71
From: FedEx <FedEx@message.fedex.com>
Reply-To: FedEx EXPRESS <donotreply@fedex.com>
Subject: FedEx Shipment Notification:Your Latest FedEx Invoice BKK0005254282
Attachment: FedEx Invoice BKK0005254282_pdf.gz (contains "gunzipped")

Loki C2:
http://missingandfound.com.my/mb/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Remcos-7759529-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 22:36:36 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ti6fb566kc7klgd4y52oqb53uzuzlsozn7llqzzcbbonp3e4qtfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 9a3c50f7de50bea5987cc774e807bba66995c9d96fd6b86722085cd7ec9c84ca

(this sample)

Loki

Executable exe e6c32ec6965b96c741a2e916faa8c1e296d8da47474fe7feda65427c9565a705

  
Dropping
MD5 01ef38a653c02d32081b61282a84e07b
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e6c32ec6965b96c741a2e916faa8c1e296d8da47474fe7feda65427c9565a705

Comments