MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45c737ee0fc435bbd549e4aed811b928dd42b2debb60be75209ad58b1e4e6607. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45c737ee0fc435bbd549e4aed811b928dd42b2debb60be75209ad58b1e4e6607
SHA3-384 hash: 1f741368721e814a93319e86c444042328e9618d20069b6a2aa804edb491eb8141f37d372fad63e59c2401cca7f13da8
SHA1 hash: 1b75c7bbc216e12c35382fe5849518f8bd4b369b
MD5 hash: c3ca302e0bd448039aebd56d0174fcec
humanhash: california-missouri-twenty-stream
File name:Recibo de TNT_pdf.z
Download: download sample
Signature Loki
Create hunting rule
File size:318'789 bytes
First seen:2020-10-13 05:48:05 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:SvzRmyao4UJZh95ouGQR5qsndgP6JZRD9FdaxJqTvrfQaIAgPljl:SvzUUJjjZGqQ0vJZRpPHf3o5
TLSH BB642330EF3F2CDB326C77B1A2EF32F1B2D26284914A55005EF454563EA169EA93E113
Reporter abuse_ch
Tags:Loki TNT z


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.mozadom.ga
Sending IP: 168.235.109.227
From: ENTREGA EXPRESS TNT <noreply@tnt.com.pe>
Subject: NOTIFICACIÓN DE CONSIGNACIÓN DE TNT
Attachment: Recibo de TNT_pdf.z (contains "Recibo de TNT_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/45c737ee0fc435bbd549e4aed811b928dd42b2debb60be75209ad58b1e4e6607/
Threat name:
Win32.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 00:42:48 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ixdtp3qpyq23xvkj4sxnqenzfdoufmw6xnql45jatlkywhsomydq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/45c737ee0fc435bbd549e4aed811b928dd42b2debb60be75209ad58b1e4e6607

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z 45c737ee0fc435bbd549e4aed811b928dd42b2debb60be75209ad58b1e4e6607

(this sample)

Loki

Executable exe 95d5b650aa34dcd58ad03885813e1c3d4b3ea4e1975ced2c1a3d966e3afd8abb

  
Dropping
MD5 09c21868826b617305cace33035a22ae
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 95d5b650aa34dcd58ad03885813e1c3d4b3ea4e1975ced2c1a3d966e3afd8abb

Comments