MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95108c591f3277da0dab78075854190d3698929071a29ff9b7a4cab7a3e9b1e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 95108c591f3277da0dab78075854190d3698929071a29ff9b7a4cab7a3e9b1e5
SHA3-384 hash: 7cbc06bfdae77097a61d3a6bb9e57f85c3685b77607ea75db9c297cf83c649e2aedf488dc1089f785d17daa9592fa78f
SHA1 hash: 4bdab1e831bbbf9038cc82e86c22a00007d096cd
MD5 hash: c9b5771b360244c942f09db2d1f048ed
humanhash: spaghetti-september-bluebird-kentucky
File name:ABRECHNUNGSRECHNUNG 267000863645.PPTXL.gz
Download: download sample
Signature Loki
Create hunting rule
File size:189'528 bytes
First seen:2020-11-30 08:17:38 UTC
Last seen:2020-11-30 10:55:55 UTC
File type: gz
MIME type:application/gzip
ssdeep 3072:PUjcrDaEKNX97oe3mpEsFiKN0WVKQpkgh139UGV1wJ2q2/iWXn2r2uiKi/lJy:P0ctKNbWq7A0bQqgrbV1wMqcXsGJlQ
TLSH 6D04137CF3993FE4437B4E2AC547C28205BAC4058605DE739AAC943B269356CD27A72B
Reporter lowmal3
Tags:Loki

Intelligence

File Origin
# of uploads :
14
# of downloads :
138
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.16716.28100.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/95108c591f3277da0dab78075854190d3698929071a29ff9b7a4cab7a3e9b1e5/
Threat name:
Win32.Trojan.Glupteba
Create hunting rule
Status:
Malicious
First seen:
2020-11-30 08:18:10 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=suiiywi7gj35udnlpadvqvazbu3jreuqogrj76nxutflpi7jwhsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/95108c591f3277da0dab78075854190d3698929071a29ff9b7a4cab7a3e9b1e5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 95108c591f3277da0dab78075854190d3698929071a29ff9b7a4cab7a3e9b1e5

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments


Avatar
Corsin Camichel commented on 2020-11-30 08:30:32 UTC

Malspam
From: Sean Zhang Swantje Johannsen <retoure.augustin-group.de@525.vkli.ml>
Subject: AW: ZU MACHENDE TRANSFERS
Attachment: "ABRECHNUNGSRECHNUNG 267000863645.PPTXL.gz"