MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05c1ff16522ee4eb47fc7f85b541e2622c91d573ef80980724c97676bf321cf3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 05c1ff16522ee4eb47fc7f85b541e2622c91d573ef80980724c97676bf321cf3
SHA3-384 hash: 14e0f8a7928c2080e0d82037057e023ac4d21462febce04accc6a9af0bf11e96d4bb3750754ccdde69bd81bdcc829774
SHA1 hash: d2e055357f2ec473e81b42bd6553ff7613f2c850
MD5 hash: 4f34816abf0e817fafa2d410c52f2030
humanhash: hot-double-venus-mobile
File name:Original Inv_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:437'486 bytes
First seen:2020-10-12 14:51:22 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:bd4adLs6c4ey9Pu8WvcVJrd/8ER+Tcd0r1jqQL/yM:fLs6h592vcP/8EMwGZ9
TLSH F19423AD20A9E96773698031CED3816F6B537A506BA084A0D5CD0EE251BFF093C3CCD9
Reporter abuse_ch
Tags:gz Loki TNT


Avatar
abuse_ch
Malspam distributing Loki:

HELO: cloud.konnectdigital.com.au
Sending IP: 223.27.23.32
From: TNT Express <worldwide@tnt.com>
Subject: TNT Express Shipment
Attachment: Original Inv_pdf.gz (contains "Original Inv_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.445.18430.7107.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/05c1ff16522ee4eb47fc7f85b541e2622c91d573ef80980724c97676bf321cf3/
Threat name:
Win32.Malware.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-12 11:04:17 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=axa76fssf3sowr74p6c3kqpcmiwjdvlt56ajqbzezf3hnpzsdtzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/05c1ff16522ee4eb47fc7f85b541e2622c91d573ef80980724c97676bf321cf3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 05c1ff16522ee4eb47fc7f85b541e2622c91d573ef80980724c97676bf321cf3

(this sample)

Loki

Executable exe 71efb1afd621bbe994a4bf1c6b6e9c4f2d9955d320bc2a57a484287c1e74102b

  
Dropping
MD5 24e3a791ad8c7553becd576f515a4495
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 71efb1afd621bbe994a4bf1c6b6e9c4f2d9955d320bc2a57a484287c1e74102b

Comments