MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61389968a67ea866267a4c20d0abf98ffe41214dccd307c839db9d6c99f779f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61389968a67ea866267a4c20d0abf98ffe41214dccd307c839db9d6c99f779f6
SHA3-384 hash: d7ca7e5dc3d33c6cf65655648fc402c1e74beb152fe3ff78b0896df0fa4ba9ea523fae22c0ada18812162f2555d286f0
SHA1 hash: db226d7906f601f8ac572638f4e3e99b386588c4
MD5 hash: 6b5d2929f15ebaaa27a696a4aa1d85ec
humanhash: sad-eleven-alaska-west
File name:Shipping Details_PDF.rar
Download: download sample
Signature Loki
Create hunting rule
File size:460'723 bytes
First seen:2021-02-18 12:26:01 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:nX6nyoxQ820zUxQG2S5zZhnAkulV5VUW//An3qgCyUFL4wPgdc5gOQ71xmIrj:X6y02oU6JzzyW//An3tgBPqc2Rxmy
TLSH 72A423A07082F02D56AFBD226A55B914B1375C2280B533DDCFD5A4CCAA4BF22971AC77
Reporter cocaman
Tags:Loki rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""TNT Express" <service@tnt.com>" (likely spoofed)
Received: "from nl0.523.bnjo.gq (unknown [157.245.42.21]) "
Date: "Thu, 18 Feb 2021 04:03:18 -0800"
Subject: "TNT Notification Consignment No: 0468356390 -Confirm your Shipment URGENT"
Attachment: "Shipping Details_PDF.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61389968a67ea866267a4c20d0abf98ffe41214dccd307c839db9d6c99f779f6/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-02-18 12:26:06 UTC
File Type:
Binary (Archive)
Extracted files:
21
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=me4js2fgp2ugmjt2jqqnbk7zr77eciknztjqpsbz3oowzgpxph3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/61389968a67ea866267a4c20d0abf98ffe41214dccd307c839db9d6c99f779f6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 61389968a67ea866267a4c20d0abf98ffe41214dccd307c839db9d6c99f779f6

(this sample)

Loki

Executable exe 1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287
  
Dropping
Loki

Comments