MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d4521c2e503d331bd87654d534d44cc90e0fc22b1fb9ddbcbebc631963131bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1d4521c2e503d331bd87654d534d44cc90e0fc22b1fb9ddbcbebc631963131bd
SHA3-384 hash: 6dcfcc8c9318569373d4ea30d49102e15b3b47e2c98650869e92e306a9a08b7b479f2549a1513a3f210b8c83190234f9
SHA1 hash: c76f44c5e151a02c1852b5591c30ec41fa6998d9
MD5 hash: 97afe0f68566a2a825c39c297452f740
humanhash: salami-mars-ohio-yankee
File name:shipping details _pdf.rar
Download: download sample
Signature Loki
Create hunting rule
File size:333'209 bytes
First seen:2020-05-27 04:28:13 UTC
Last seen:2020-05-27 08:32:18 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:m+XoCat40twYe7ug1+bn3W2dIOUV+WU54eRMwF1op/bNgxTUb0r2Nr9:pXp0twqg1+bm0brMsI2xTkP9
TLSH 646423748A9CC7DB16233FB0455A42322254A4F60D05928A783F3BBBDC9E5FE269C357
Reporter cocaman
Tags:Loki rar


Avatar
cocaman
Malicious email
From: =?utf-8?b?IlROVMKuIEVYUFJFU1MgSU5DIiA8c2VydmljZUB0bnQuY29tPg==?=@zimbra.naled.local
Received: from mx1.naled.rs (mx1.naled.rs [188.93.126.156])
Date: Tue, 26 May 2020 23:23:19 -0700
Subject: TNT Express delivery Consignment Notification
Attachment: shipping details _pdf.rar

Intelligence

File Origin
# of uploads :
2
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 04:35:24 UTC
File Type:
Binary (Archive)
Extracted files:
264
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 1d4521c2e503d331bd87654d534d44cc90e0fc22b1fb9ddbcbebc631963131bd

(this sample)

Loki

Executable exe 50718583f71413c3eaeb95f88c1ad4e0b12958758de441ee6a0a20c072a26142

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 50718583f71413c3eaeb95f88c1ad4e0b12958758de441ee6a0a20c072a26142
  
Dropping
Loki

Comments