MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ddf2bb3985f69914d7618400ee1df99ea6ba21e69ea955cf5cf42fe13f2b37ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ddf2bb3985f69914d7618400ee1df99ea6ba21e69ea955cf5cf42fe13f2b37ea
SHA3-384 hash: 1c78bb2b8eb10bb14d2c2cc37ec5338a2e101330e82e57c0c5bcd10c64883886433abfc25096925b6c783e1add4dd479
SHA1 hash: ca2b355f2c16d6041f2895fb41540edec696ae63
MD5 hash: f924f95cddf6efb71cb0103471559dcb
humanhash: georgia-oranges-lamp-pip
File name:Remittance Slip_06082020_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:298'727 bytes
First seen:2020-08-13 03:24:57 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:U6mUtIBMd4FwvUtWbOBu9J//e5uapiwd2te6aTROXzZH:UzB84KQpuScpHe6amZH
TLSH 0B542384DFC98BEF8911B8F5CCB85726A578DD6C6E431AF243029B309CF50A6C8186F1
Reporter cocaman
Tags:gz Loki


Avatar
cocaman
Malicious email
From: Jeff Zhang <jeff.zhang@spxflow.com>
Received: from john.com (unknown [117.121.213.217])
Date: Fri, 07 Aug 2020 06:58:32 +0100
Subject: RE: May 2020 SOA Remittance Slip for USD$66,150
Attachment: Remittance Slip_06082020_pdf.gz

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ddf2bb3985f69914d7618400ee1df99ea6ba21e69ea955cf5cf42fe13f2b37ea/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-07 12:21:24 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3xzlwomf62mrjv3bqqao4hpzt2tluipgt2uvlt246qx6cpzlg7va._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ddf2bb3985f69914d7618400ee1df99ea6ba21e69ea955cf5cf42fe13f2b37ea

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip ddf2bb3985f69914d7618400ee1df99ea6ba21e69ea955cf5cf42fe13f2b37ea

(this sample)

Loki

Executable exe dc2435622376b023e99e165f3615fcfdb35b8ed157af0ac2fcd3cdf8242592d8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dc2435622376b023e99e165f3615fcfdb35b8ed157af0ac2fcd3cdf8242592d8
  
Dropping
Loki

Comments