MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b00149cbb1de6e7204cfb82296c59dfc4c802356ccd708f52ae7da9a651861d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b00149cbb1de6e7204cfb82296c59dfc4c802356ccd708f52ae7da9a651861d
SHA3-384 hash: 22489ce146c7ca06e6d7afa9b69fac6188fd7fbfeae3e9b9b7a8f7ae04964913a5680957471ed9533728934f182d5599
SHA1 hash: 1fb06bb319dc7ea1942c6318f3a8d775810808a3
MD5 hash: c4b812c778243e5ea786222255538a3d
humanhash: purple-summer-ink-fillet
File name:CUSTOMETR ADVISORY 0162020 OR SERVICE DEPARTMENT.PDF.gz
Download: download sample
Signature Loki
Create hunting rule
File size:297'226 bytes
First seen:2020-08-18 12:28:48 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:6mPX7bF7fqJGqnQK7wi7wE7HTFDAXLiQMynHcqqkuNdGVGxDzfG:XPrbC/jwuTBs/5uXW
TLSH DC5423719A07B4C43B232F635FA1A1852446D9CF29E00E36EB78D4FFAA752492DDDD20
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.negoelectrindo.co.id
Sending IP: 103.253.68.132
From: CMA CGM || DJA <DJA.MANIFEST@cma-cgm.com>
Subject: ! CMA CGM WORLDWIDE SHIPPING : CUSTOMER ADVISORY #0162020 : Change in e-mail address for Customer Service Department
Attachment: CUSTOMETR ADVISORY 0162020 OR SERVICE DEPARTMENT.PDF.gz (contains "CUSTOMETR ADVISORY 0162020 OR SERVICE DEPARTMENT.PDF.exe")

Loki C2:
http://venitronics.com/oo/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9b00149cbb1de6e7204cfb82296c59dfc4c802356ccd708f52ae7da9a651861d/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 12:30:08 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tmabjhf3dxtooicm7obcs3cz37cmqarvntgxbd2svz62tjsrqyoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9b00149cbb1de6e7204cfb82296c59dfc4c802356ccd708f52ae7da9a651861d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 9b00149cbb1de6e7204cfb82296c59dfc4c802356ccd708f52ae7da9a651861d

(this sample)

Loki

Executable exe 14cf1094b24ff91c06ca57e8916ccbf9d9f0d5cdc8ebae51aa36069aed20e5ea

  
Dropping
MD5 6693bca84002236735b9e0ae1bd19fce
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 14cf1094b24ff91c06ca57e8916ccbf9d9f0d5cdc8ebae51aa36069aed20e5ea

Comments