MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 719e1f45444fa850ab9d4cd28749d82c4e044a9211cb451a0a0da760421d64cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 719e1f45444fa850ab9d4cd28749d82c4e044a9211cb451a0a0da760421d64cf
SHA3-384 hash: 75142b147159a51c89f817263681e6ebc1e46331fa441670615c7aecdf42d807d2256e217690c4942bc98cc8feb88c83
SHA1 hash: 68ece2afbb48967274c5a2770d99e2f8bb272036
MD5 hash: 6ea27b359ffa9cb9ecf810227d09f36d
humanhash: fish-montana-blossom-don
File name:TNT Delivery Report Notification.gz
Download: download sample
Signature Loki
Create hunting rule
File size:579'980 bytes
First seen:2021-01-11 08:52:00 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:RYWr/bJkgdmVA/bUcwbYyel8btdj0dVk/z9kcBFRY+dx4ziN1Oqh:RYWhzQyDuhL7vtdxuiNsG
TLSH BFC42383CAC727265427542D30A9C86DAAC2906CE847536A6D35DF8EFC9500BBFFD538
Reporter abuse_ch
Tags:gz Loki TNT


Avatar
abuse_ch
Malspam distributing Loki:

HELO: sdk0.507.gdxox.ml
Sending IP: 167.99.171.216
From: TNT Shipment Notification <tnt@507.gdxox.ml>
Subject: TNT EXPRESS NOTIFICATION **Waybill number: 132797239
Attachment: TNT Delivery Report Notification.gz (contains "TNT Delivery Report Notification.exe")

Loki C2:
http://51.195.53.221/p.php/dUQz9bwGRLNK7

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen11.57608.9631.29480.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/719e1f45444fa850ab9d4cd28749d82c4e044a9211cb451a0a0da760421d64cf/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-11 08:52:10 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ogpb6rkej6ufbk45jtjiosoyfrhaisuschfukgqkbwtwaqq5mthq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/719e1f45444fa850ab9d4cd28749d82c4e044a9211cb451a0a0da760421d64cf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 719e1f45444fa850ab9d4cd28749d82c4e044a9211cb451a0a0da760421d64cf

(this sample)

Loki

Executable exe d8c75bc438ec5aced7b348cbb95cc0e1da4da409ad464d1ebe9fbae9f8a21a3c

  
Dropping
MD5 ff230eb127d1958ab5e4caa3d44f783e
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d8c75bc438ec5aced7b348cbb95cc0e1da4da409ad464d1ebe9fbae9f8a21a3c

Comments