MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5270738bad702186ce28035caad0273ba4fa4f53c0012a8be7b7c8f621096b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5270738bad702186ce28035caad0273ba4fa4f53c0012a8be7b7c8f621096b1
SHA3-384 hash: b4db80b426d6ed68f12c17d181883588717f72bee12ada4d36845d125233324b874ce5287cd758df6e79741012bc4679
SHA1 hash: fa06ac60a4b458d7cdb65f47ec8c5ba6a81a8e8a
MD5 hash: a3964a5cb7b2ffda1f26e7dcb9a52be2
humanhash: robert-crazy-carpet-india
File name:DHL Express_Invoice-MAJW.gz
Download: download sample
Signature Loki
Create hunting rule
File size:458'742 bytes
First seen:2020-07-08 05:09:13 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:2BfFhruQfnDmNiXOaFKAoZ3kiU5sH4zd86Dzd:2rhrDnqNiDFzqAO4C6d
TLSH A3A423A837D7D731BE702C2E45F255FD4AA06F758864A30D073290DA111D96F88EEBB2
Reporter cocaman
Tags:gz Loki


Avatar
cocaman
Malicious email
From: =?UTF-8?Q?DHL_EXPRESS=C2=A9?= <istiami@sinokor.co.id>
Received: from cpanel3.centrin.net.id (cpanel3.centrin.net.id [202.146.241.47])
Date: Wed, 08 Jul 2020 07:51:29 +0700
Subject: Electronic invoice generated by DHL Express_Invoice-MAJW-08-07-2020:
Air Waybill no 1395482082
Attachment: DHL Express_Invoice-MAJW.gz

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d5270738bad702186ce28035caad0273ba4fa4f53c0012a8be7b7c8f621096b1/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-08 05:11:04 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2utqoof224bbq3hcqa24vlicoo5e7jhvhqabfkf6pn6i6yqqs2yq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz d5270738bad702186ce28035caad0273ba4fa4f53c0012a8be7b7c8f621096b1

(this sample)

Loki

Executable exe b0cc51f23ac5a30c25ecd9e817b445d66027872eff2dcbe9ea1808a945f6be98

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b0cc51f23ac5a30c25ecd9e817b445d66027872eff2dcbe9ea1808a945f6be98
  
Dropping
Loki

Comments