MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3488ce75eba057d6341622d3e2a071df8e5f5a3631489e6dc49962b61f7d39f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3488ce75eba057d6341622d3e2a071df8e5f5a3631489e6dc49962b61f7d39f3
SHA3-384 hash: 38a196d27e7d62b4b473b4d6045ce07808c3797d2f062b09556f0e3ecf1c85bff9a412c6bd68da13af410770718ab6bf
SHA1 hash: 8a35f992229903fda062837311efbacdde140fe1
MD5 hash: 366d047e821919858133a67bcf0af145
humanhash: sodium-enemy-earth-carolina
File name:TNT Delivery Report Notification.gz
Download: download sample
Signature Loki
Create hunting rule
File size:480'864 bytes
First seen:2021-01-12 07:25:18 UTC
Last seen:2021-01-12 09:23:47 UTC
File type: gz
MIME type:application/gzip
ssdeep 6144:wqcfl/WgXeTC97dfCHf36kVw4XKX0R4Gedo2cF6uR/v2k8aXQlmvvv/reF3eTIog:w3d2Cb6/5RKX7dHO6Fk8XloH/A3UIong
TLSH C6A423ACA8507ABE535647B323AB40E4EC8EC808A77DE5040177DBE5727B4F65B41BD0
Reporter abuse_ch
Tags:gz Loki TNT


Avatar
abuse_ch
Malspam distributing Loki:

HELO: cds0.519.xvwox.ml
Sending IP: 167.172.160.128
From: "TNT Shipment Notification" <tnt@519.xvwox.ml>
Subject: TNT EXPRESS NOTIFICATION **Waybill number: 132797239
Attachment: TNT Delivery Report Notification.gz (contains "TNT Delivery Report Notification.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
151
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen11.57608.1769.15442.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3488ce75eba057d6341622d3e2a071df8e5f5a3631489e6dc49962b61f7d39f3/
Threat name:
Win32.Trojan.Bulz
Create hunting rule
Status:
Malicious
First seen:
2021-01-12 07:26:17 UTC
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gsem45plubl5mnawelj6fidr36hf6wrwgfej43oetfrlmh35hhzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3488ce75eba057d6341622d3e2a071df8e5f5a3631489e6dc49962b61f7d39f3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 3488ce75eba057d6341622d3e2a071df8e5f5a3631489e6dc49962b61f7d39f3

(this sample)

Loki

Executable exe 210883cd941e8c923b24deb108f84af9aede53350f8111ed83d1efc8eca8c1ba

  
Dropping
MD5 f9973e8f4dc8908e2605849baca7fd99
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 210883cd941e8c923b24deb108f84af9aede53350f8111ed83d1efc8eca8c1ba

Comments