MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abd69b19ba0706ed1261c3f68ef09fee778dad3d26fbd265274cb0615f1ca1ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: abd69b19ba0706ed1261c3f68ef09fee778dad3d26fbd265274cb0615f1ca1ff
SHA3-384 hash: ee218594b5e2098e38e9a440aa05328a759146cc10336a13c63e7a675d85c5ced70be511fcf89ba9a3ec2522a1f9e417
SHA1 hash: 0adaf3749d1cbca92bcd7822f87a58d1dcb4b7f2
MD5 hash: ed0b2ee42280f10299fb750166513ff1
humanhash: oven-floor-ack-oregon
File name:Nota di consegna_TVX507CX.iso
Download: download sample
Signature Loki
Create hunting rule
File size:585'728 bytes
First seen:2020-12-02 09:07:52 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:/k4xGbsp05fYveHK+0J/Rw1vvnumvY7/8qsT4mP:/kIQvHbwEnntY7/FsT4Q
TLSH 1DC4BF103A01C436D2E232784F69DBB997A9AC54072151C77BFC7E6B7BBE6D36930206
Reporter abuse_ch
Tags:iso Loki TNT


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server1.ataka.lv
Sending IP: 81.94.231.162
From: TNT EXPRESS <tnt.customer.servicesemail@tnt.com>
Subject: R: Nota di consegna per referenza di contatto_TVX507CX
Attachment: Nota di consegna_TVX507CX.iso (contains "Nota di consegna_TVX507CX.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Firseria-6804617-0
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/abd69b19ba0706ed1261c3f68ef09fee778dad3d26fbd265274cb0615f1ca1ff/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vpljwgn2a4do2etbyp3i54e75z3y3lj5e355ezjhjsygcxy4uh7q._file
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/abd69b19ba07/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/abd69b19ba0706ed1261c3f68ef09fee778dad3d26fbd265274cb0615f1ca1ff

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

iso abd69b19ba0706ed1261c3f68ef09fee778dad3d26fbd265274cb0615f1ca1ff

(this sample)

Loki

Executable exe ed0854c940f926f1e0fffedbb7932712a8abe8f23900d1cc27db06c1699221c7

  
Dropping
MD5 f5bce1fb7e37976dc8df996ca761fc2f
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ed0854c940f926f1e0fffedbb7932712a8abe8f23900d1cc27db06c1699221c7

Comments