MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05d092042ed2f4b95e3451b01b80817587a56783fbb37536708872aec525913d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 05d092042ed2f4b95e3451b01b80817587a56783fbb37536708872aec525913d
SHA3-384 hash: b0eb6d9b382287137eac4f4937016934454d5310efd4a447981e90d0a5c695b3706dc340420ad162c49c21c8950d5164
SHA1 hash: d16f8a5e2be3b03a3cf34fe6a8c3df18cd1dcbfc
MD5 hash: 627c4a9e5c4a2e60d08cc0b964160ae1
humanhash: west-two-sodium-item
File name:Recibo TNT_pdf.z
Download: download sample
Signature Loki
Create hunting rule
File size:318'779 bytes
First seen:2020-10-13 05:54:29 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:8vzRmyao4UJZhedSvcCssFWE91kZJl0im4iXydNaWIv1YShxMWUo1:8vzUUJjeEc6Q1kX2ICyxp
TLSH 7E6423BC8137EDA073EEA7EB966F23E9403978446C8601063A9FEDA8E70567D705C345
Reporter abuse_ch
Tags:BRA geo Loki TNT z


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.mozadom.ga
Sending IP: 168.235.109.227
From: NOTIFICAÇÃO DE REMESSA TNT <noreply@tnt.br>
Subject: NOTIFICAÇÃO DE REMESSA TNT
Attachment: Recibo TNT_pdf.z (contains "Recibo TNT_pdf.exe")

Loki C2:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/05d092042ed2f4b95e3451b01b80817587a56783fbb37536708872aec525913d/
Threat name:
Win32.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 22:19:43 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=axijebbo2l2lsxrukgybxaebowd2kz4d7ozxkntqrbzk5rjfse6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/05d092042ed2f4b95e3451b01b80817587a56783fbb37536708872aec525913d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z 05d092042ed2f4b95e3451b01b80817587a56783fbb37536708872aec525913d

(this sample)

Loki

Executable exe 72e8b3fd24829835385355fcc25e832e71b2303a730f06c95c97b4227176baa2

  
Dropping
MD5 b2253d7d83e98e13d346d8f5b59be824
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 72e8b3fd24829835385355fcc25e832e71b2303a730f06c95c97b4227176baa2

Comments