MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c115659e53ef7d537ba43e3dbb56a9b3b193ed5d1e851486a6def016625bc876. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c115659e53ef7d537ba43e3dbb56a9b3b193ed5d1e851486a6def016625bc876
SHA3-384 hash: 5e2701ec86df8f1ef5dde81ab6160cb2a2dbfdc5a3600b467a82f1f8425229ba01807505bc75e2789c19304d390d0931
SHA1 hash: 31b4aed759b37f090b6299b230eea7a794029e31
MD5 hash: eb486de9cc8ddc1561d13c6bc63a8359
humanhash: rugby-comet-nine-bluebird
File name:Shipping Document_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:406'119 bytes
First seen:2020-05-01 11:21:54 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:FxsJqLoRFKzwFZ8sOWJI167RptQO3DW6wfjr5k:Fx8qLouZsO+RpVrwfxk
TLSH B6842371C7E5A6EE262D93CA83FD18EE532DEC7E449928807E7436665907F82091D02F
Reporter abuse_ch
Tags:DHL gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: ip-172-31-21-154.ec2.internal
Sending IP: 54.145.164.71
From: DHL Express <bdcare@dhl.com>
Reply-To: DHL customer service <ricknicolas.aol@hotmail.com>
Subject: DHL Shipment Delivery Air Waybill NO: 004536563
Attachment: Shipping Document_pdf.gz (contains "Shipping Document_pdf.exe")

Loki C2:
http://missingandfound.com.my/mb/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.LokiBot-7744093-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Win32.Injector.ELSC.32193.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 11:36:15 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
31 of 48 (64.58%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yekwlhst556vg65ehy63wvvjwoyzh3k5d2crjbvg33ybmys3zb3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz c115659e53ef7d537ba43e3dbb56a9b3b193ed5d1e851486a6def016625bc876

(this sample)

Loki

Executable exe f37e150f7ac1a5fbd8541b51f7b42951d4858caafcd29ee15d48020d58035efa

  
Dropping
MD5 ae5f3cfbb67918db385c4be8b62e9703
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f37e150f7ac1a5fbd8541b51f7b42951d4858caafcd29ee15d48020d58035efa

Comments