MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce2b2274201d87e5a594941f5240085afe32941702d5548b8b9504fc16b86a64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce2b2274201d87e5a594941f5240085afe32941702d5548b8b9504fc16b86a64
SHA3-384 hash: 5916e93e61bf98f1af4afca81f352bcd845fd37872f0abeaf87ffaf5a2fd1baa9d158c3e7cb802903340ec9ad632b9ae
SHA1 hash: 5d5746dd910deef5759632e3295c32ebf798b18a
MD5 hash: abb920d44b59da201a63a82ccb522822
humanhash: vermont-wyoming-five-fish
File name:Original Invoice_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:316'079 bytes
First seen:2020-10-19 10:02:48 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:azDb/9P9wzR3qXoILfGrtI1IGwP0GnBIh84mOfZXRsceSMYDWZDFjEPCKJXkyzlc:aznR9wt2LuC1IV0iBh4j9jDW7QtFXWT
TLSH 646423FCDDCD7751D01E2BEAD0407E322105E82E45225F76965026828BEE377F0696EB
Reporter abuse_ch
Tags:gz Loki TNT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: sks0.726.cxino.ga
Sending IP: 46.101.180.250
From: TNT EXPRESS <support@tnt.com>
Subject: Consignment Notification: You Have A Package With Us
Attachment: Original Invoice_pdf.gz (contains "Original Invoice_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce2b2274201d87e5a594941f5240085afe32941702d5548b8b9504fc16b86a64/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 05:50:54 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zyvse5badwd6ljmusqpveqaill7dffaxalkvjc4lsucpyfvynjsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ce2b2274201d87e5a594941f5240085afe32941702d5548b8b9504fc16b86a64

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip ce2b2274201d87e5a594941f5240085afe32941702d5548b8b9504fc16b86a64

(this sample)

Loki

Executable exe 654f5bbb743d83702c9e1b41253866f395b519105abf39aa712c32d89baf3f6e

  
Dropping
MD5 735b914e2d9da8268d5fce8028a14fa2
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 654f5bbb743d83702c9e1b41253866f395b519105abf39aa712c32d89baf3f6e

Comments