MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4abf0ee7565b1383209cad054ff439bbe4430b508307ce08e4932428f0ae249c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4abf0ee7565b1383209cad054ff439bbe4430b508307ce08e4932428f0ae249c
SHA3-384 hash: 0942f4642f14d601a40d08e1386702cea046f4f5f8db71affce186878c06b010a3bb21f139bd5bbebb140ee5e68397d9
SHA1 hash: e2a403fc464089be80b2c8d1103de16d861ef307
MD5 hash: 1c219a658bbed747664718f78a859a29
humanhash: maine-crazy-sad-nitrogen
File name:TNT Original Invoicing_pdf.xz
Download: download sample
Signature Loki
Create hunting rule
File size:203'937 bytes
First seen:2020-10-27 10:02:45 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 6144:TXZMYXjMIFYGYoJNl40BpDEb2RsIO2R5E+ZMMJn04:TXZMjICGYoJNbpDG26IOQCN4
TLSH BE142349FF23DB66405E77D0C02F8DE37E9AD922CB59AEDA896908EC334658D1230477
Reporter abuse_ch
Tags:Loki TNT xz


Avatar
abuse_ch
Malspam distributing Loki:

HELO: larisaevents.gr
Sending IP: 213.239.215.207
From: einvoicing <tntsupport.admin@tnt.com>
Subject: TNT Express Invoice: 09004105 - Account: 000022245
Attachment: TNT Original Invoicing_pdf.xz (contains "TNT Original Invoicing_pdf.bat")

Loki C2:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.Generic-S.11324.11860.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4abf0ee7565b1383209cad054ff439bbe4430b508307ce08e4932428f0ae249c/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 07:15:28 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jk7q5z2wlmjygie4vucu75bzxpsegc2qqmd44chesmscr4foesoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

xz 4abf0ee7565b1383209cad054ff439bbe4430b508307ce08e4932428f0ae249c

(this sample)

Loki

Executable exe b02fe380538c1b317f665d51bd360fa5ee46399150a296c2b354b0295bef6a53

  
Dropping
MD5 ed3f6aec702ef08cfec561b98859cfc6
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b02fe380538c1b317f665d51bd360fa5ee46399150a296c2b354b0295bef6a53

Comments