MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfc9c44707362bf6bc8cc33a753fcec4222d39115e951cf0d17e47fa6a7b3d3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfc9c44707362bf6bc8cc33a753fcec4222d39115e951cf0d17e47fa6a7b3d3d
SHA3-384 hash: fa7ba4ee304edc628ca5ca3aec156f928334b08eaf98495d964759ee2fa467a0a976cf3b172a362a22d4d8a3794e17ef
SHA1 hash: f8c37ef8881d15c2f4a31f72e9b67a0c184908c1
MD5 hash: 918fd21d79f26fef7aeb1de7dd21df54
humanhash: jersey-michigan-ack-alaska
File name:CILJAK164769.gz
Download: download sample
Signature Loki
Create hunting rule
File size:229'911 bytes
First seen:2020-08-17 05:56:04 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:smF8Egx5ZzdqTWGDYonGojCrZNxL7QHeRj+d:P8Ee5xcWGDrnGo2jd4Oj+d
TLSH 802412350F69214091B772A4FADD49784F39F3F50E33AC9C29C578762CA1A614EB87D2
Reporter abuse_ch
Tags:gz Loki Maersk


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.ptjlg.co.id
Sending IP: 103.253.68.52
From: Maersk Line <finance@ptjlg.co.id>
Subject: MAERSK LINE SHIPPING DOCUMENTS
Attachment: CILJAK164769.gz (contains "CILJAK164769.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.51227.21118.29069.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cfc9c44707362bf6bc8cc33a753fcec4222d39115e951cf0d17e47fa6a7b3d3d/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 05:57:06 UTC
AV detection:
19 of 27 (70.37%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z7e4iryhgyv7npemym5hkp6oyqrc2oirl2krz4grpzd7u2t3hu6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Noon
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/cfc9c44707362bf6bc8cc33a753fcec4222d39115e951cf0d17e47fa6a7b3d3d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz cfc9c44707362bf6bc8cc33a753fcec4222d39115e951cf0d17e47fa6a7b3d3d

(this sample)

Loki

Executable exe 729b3db8ec16b0254c1c66f74a178a63ade2c12874ea42ba123bd7efc366eb38

  
Dropping
MD5 3f0eb92361d284bedb88ea31f683b625
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 729b3db8ec16b0254c1c66f74a178a63ade2c12874ea42ba123bd7efc366eb38

Comments