MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35ac86f4db8934e1c4d17321bea3616f80d6be547f2b7540e13ea319399e1b92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 35ac86f4db8934e1c4d17321bea3616f80d6be547f2b7540e13ea319399e1b92
SHA3-384 hash: 8d3f7e4d576b1e1989317b74b41693439e9aa97078b20133d3ad47ef4a1d7bf6b37219fbcb9db3aee8abcd8390ef7c96
SHA1 hash: e7f347208ad5fcc0d08bdd1d5f38bb35187625d7
MD5 hash: 2bce68ff7a36fadbe5ec1676e82453eb
humanhash: juliet-glucose-texas-football
File name:TNT Ref25-21359AWF_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:282'014 bytes
First seen:2020-08-18 09:49:05 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:0LiYpwhX0dNx8ToWH6COL0tW28PGs50Kuz7ig5yGb2ib1ww83ETX+4R7GM:0+YEZTXGL0bKC/zaGtmK7qM
TLSH E9542335AD46B0AAAF993C302CC1719210589567C646133DB72DA33CA797C728EFD2ED
Reporter abuse_ch
Tags:gz Loki TNT


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.negoelectrindo.co.id
Sending IP: 103.253.68.132
From: TNT - Invoicing System <breaji@negoelectrindo.co.id>
Subject: TNT E-Invoice No : TNT502379AWF - Parcel No : TNT 502379AWF // TOP URGENT Attention
Attachment: TNT Ref25-21359AWF_pdf.gz (contains "TNT Ref25-21359AWF_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/35ac86f4db8934e1c4d17321bea3616f80d6be547f2b7540e13ea319399e1b92/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 06:46:31 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gwwin5g3re2odrgromq35i3bn6annpsup4vxkqhbh2rrsom6doja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 35ac86f4db8934e1c4d17321bea3616f80d6be547f2b7540e13ea319399e1b92

(this sample)

Loki

Executable exe 68ac6f6254e62bc5285579d1027024a8b63f8370ece4e134361264ff53cc2294

  
Dropping
MD5 a7c665b7ef4e42eb914b1a3b83f93eb8
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 68ac6f6254e62bc5285579d1027024a8b63f8370ece4e134361264ff53cc2294

Comments