MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a13aa391e5451fe77b192ec53af540c025654f4af32a64213a535ed7e4d9a72c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a13aa391e5451fe77b192ec53af540c025654f4af32a64213a535ed7e4d9a72c
SHA3-384 hash: ff7fe941440b9b1a3c93d2d44c6271e058f788c6d2e499637c75f8b371763626461fb544a5f4c309d7750a189bbfe4ef
SHA1 hash: 8ca43972f0bdf77ffd67ee87263869f3f6936994
MD5 hash: 040a0de88152b699a40c313976606cad
humanhash: washington-single-tango-green
File name:TNT Consignment Reciept.pdf.z
Download: download sample
Signature Loki
Create hunting rule
File size:313'471 bytes
First seen:2020-10-14 16:34:03 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:8FOERvRjY5bteWGPUgj5BUplxaE2BJaLYu9LSBNRxGLi:8FOE3jYpoWHgj5BUpnaV3asuQyLi
TLSH 9864238D6341B4C4D5CC832B0931B98C6AE543FFE956C076236E5A0B3D93E5EE8D8578
Reporter abuse_ch
Tags:Loki TNT z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: correo.netgate.com.uy
Sending IP: 200.40.119.43
From: TNT EXPRESS <noreply@tnt.com>
Subject: TNT CONSIGNMENT NOTIFICATION
Attachment: TNT Consignment Reciept.pdf.z (contains "TNT Konsinye Makbuzu.pdf")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a13aa391e5451fe77b192ec53af540c025654f4af32a64213a535ed7e4d9a72c/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 16:02:46 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ue5khepfiup6o6yzf3ctv5kayaswkt2k6mvgiij2knpnpzgzu4wa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a13aa391e5451fe77b192ec53af540c025654f4af32a64213a535ed7e4d9a72c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z a13aa391e5451fe77b192ec53af540c025654f4af32a64213a535ed7e4d9a72c

(this sample)

Loki

Executable exe b1c8d5f3238ee83c78d3b8f2d8d343b520f88dd572830b101ace804cfa8a832e

  
Dropping
MD5 54c00f07cf29e0c78061bf0563192e6e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b1c8d5f3238ee83c78d3b8f2d8d343b520f88dd572830b101ace804cfa8a832e

Comments