MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7dd315582a2f2da8e69dea470938cbdb2887ddf3a835ffb9e3a4a8887b409878. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7dd315582a2f2da8e69dea470938cbdb2887ddf3a835ffb9e3a4a8887b409878
SHA3-384 hash: e85da8d60808b8f571e9088ffdced12d9a9dea03607899f54893a2b374d87a364a9ca7bdd5ba28a95ea6645a4c99737c
SHA1 hash: 6da2a5b040ab3c1b678d3da1005eb4731daa441f
MD5 hash: 8ae29add8e521d9ade1a1ea3b4c4937e
humanhash: india-winter-harry-romeo
File name:TNT E-Invoicing.gz
Download: download sample
Signature Loki
Create hunting rule
File size:356'960 bytes
First seen:2020-10-20 11:51:58 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:tQLGvLC27N4uxzwHClsmdppCjN0ZhrUF2Xc6bvUBFihX5K2MjfzlAXwCz74l+hHB:iLGvj7KuPppSjcXchX+Zz7A+37UCL
TLSH 9174230BC143D3C9CB821EB81F21545BADAC54498B1EACB7F461F3E264A26F3A9974D1
Reporter abuse_ch
Tags:gz Loki TNT


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server.tuguhotels.com
Sending IP: 103.219.251.235
From: TNT Express <saigonsan@tuguhotels.com>
Reply-To: jp.einvoicing@tnt.com
Subject: TNT E-Invoicing Notification Consignment No: 0468356390 - URGENT
Attachment: TNT E-Invoicing.gz (contains "TNT E-Invoicing.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

PUA.Win.Adware.Webalta-6912039-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7dd315582a2f2da8e69dea470938cbdb2887ddf3a835ffb9e3a4a8887b409878/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 09:36:55 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pxjrkwbkf4w2rzu55jdqsogl3muipxptva277opdusuiq62atb4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7dd315582a2f2da8e69dea470938cbdb2887ddf3a835ffb9e3a4a8887b409878

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 7dd315582a2f2da8e69dea470938cbdb2887ddf3a835ffb9e3a4a8887b409878

(this sample)

Loki

Executable exe 099585dece2a535d3c7445453617e80e0f56e63fea64c305089cf3f945718b32

  
Dropping
MD5 00f084332e8e57524ca3f17b7f66826d
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 099585dece2a535d3c7445453617e80e0f56e63fea64c305089cf3f945718b32

Comments