MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a7a468bbb001cbde941c90f5ce1f8f087168877d6046fe6351b61f98aa4e9bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a7a468bbb001cbde941c90f5ce1f8f087168877d6046fe6351b61f98aa4e9bb
SHA3-384 hash: 1e3c3e3aff46419804bd0ef7c0858cd81f3fdbbbde184deb6187b92fa7c501581695e356cf05ceb95b9a4b342899fb6b
SHA1 hash: 449575fd9363b08acc27a0676855e5ab3ad3d2f4
MD5 hash: 1b89f45ddff64faf9c78d82667c37219
humanhash: earth-tennessee-double-skylark
File name:Scan Document01_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:312'168 bytes
First seen:2020-10-15 13:05:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:0kASEJ9dBukTRxpqYBSvMPoeQpInEHTHU7X+DmXNtfCIZApQ9:0cE33NrpqqQmOTeuDi1CIz
TLSH 1F6423A8C2E3B4159E2F7344A1CBA0B88A2155721796D32BCBCE36171909771CB1D7FD
Reporter abuse_ch
Tags:gz Loki TNT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: xbx0.526.fdion.ml
Sending IP: 128.199.23.220
From: TNT EXPRESS <Airene.Jovellanos@tnt.com>
Subject: Consignment Notification: WB-260820200131222
Attachment: Scan Document01_pdf.gz (contains "Scan Document01_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9a7a468bbb001cbde941c90f5ce1f8f087168877d6046fe6351b61f98aa4e9bb/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 10:02:39 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tj5enc53aaol32kbzehvzypy6cdrncdx2ycg7zrvdnq7tcve5g5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9a7a468bbb001cbde941c90f5ce1f8f087168877d6046fe6351b61f98aa4e9bb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 9a7a468bbb001cbde941c90f5ce1f8f087168877d6046fe6351b61f98aa4e9bb

(this sample)

Loki

Executable exe 8296fc5a42ac0a0758e33d936bb2de975fdf4191d96d4368c8cd61103d0c97b8

  
Dropping
MD5 4d6bd29132372255a1974db3b5c4c992
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8296fc5a42ac0a0758e33d936bb2de975fdf4191d96d4368c8cd61103d0c97b8

Comments