MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8275e3bbada003040a6dcab72586b102aaec27f8363679df7c31ff192d82f8dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8275e3bbada003040a6dcab72586b102aaec27f8363679df7c31ff192d82f8dd
SHA3-384 hash: 33c9a1792e75beead353555066d56c03681abeb3189f8697c914bb9bfa1be27a6692457f2b657f1b3e6ea0e3a864f142
SHA1 hash: 367bcd1686adf22ddbb3f28ebacca96b573b116d
MD5 hash: 013eaa765af5872d6186ed9ca5803efb
humanhash: orange-artist-enemy-carolina
File name:Tnt consignment invoice 20-10-2020.zip
Download: download sample
Signature Loki
Create hunting rule
File size:364'821 bytes
First seen:2020-10-20 11:47:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:LLr3kVTP3SurExiB9O5WCxeAVYmbX4U13G/JCGjo6VQrKnT2b4XhkzgDq73oDR99:YVTPSmP9OsUIw3Ifjo/s7Xhkz0q3oDc0
TLSH C974232043B9196ACA142A17D9E65B83FB6EB55332FE13C79FDC2923F055590CFA48C8
Reporter abuse_ch
Tags:Loki TNT zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: jktd3khmail01v.cloudkilat.me
Sending IP: 103.23.20.233
From: TNT consignment notification <shipment@tnt.com>
Subject: TNT Invoice 213596003.
Attachment: Tnt consignment invoice 20-10-2020.zip (contains "cypted_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

PUA.Win.Adware.Webalta-6912039-0
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8275e3bbada003040a6dcab72586b102aaec27f8363679df7c31ff192d82f8dd/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 10:48:52 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qj26ho5nuabqictnzk3slbvrakvoyj7ygy3htx34gh7rslmc7doq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8275e3bbada003040a6dcab72586b102aaec27f8363679df7c31ff192d82f8dd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 8275e3bbada003040a6dcab72586b102aaec27f8363679df7c31ff192d82f8dd

(this sample)

Loki

Executable exe 910d4e264036f52b56c864e80360fed814b1baa8ef78f4361cf156e026c7b792

  
Dropping
MD5 ac90765bd67bab9299ce515b424c7999
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 910d4e264036f52b56c864e80360fed814b1baa8ef78f4361cf156e026c7b792

Comments