MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcb87f3395dfaf9e269adba3a1e4d4131b1a9a5a2144b097a9ea32bb50337939. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dcb87f3395dfaf9e269adba3a1e4d4131b1a9a5a2144b097a9ea32bb50337939
SHA3-384 hash: ee4b720c7d5511c920e7ca3123e58924d4ec98d4a787d7b530d795d0237946b1d411eddba0d09ab56a05fd9fe96e1431
SHA1 hash: 737e35f6deaf1326691da20d87e8d57fc1300374
MD5 hash: da25e3ec3e6a20e178b75569dc9881e5
humanhash: georgia-fish-march-utah
File name:TNT TARİFİ_pdf.z
Download: download sample
Signature Loki
Create hunting rule
File size:388'332 bytes
First seen:2020-07-03 12:40:07 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:7ki1e9nmSGbQ1kALshYqNYH7KQUguAimLpjjs2k8xwqKVLecre0BdEdsIeLSZi:769n6bQ1kALcYqN6Vxns2fwxrnusnLL
TLSH F184234D23CA41AAD577274B3B4DD7A14B38BF36D6B8611C87B37C290A914D2FB6402E
Reporter abuse_ch
Tags:geo Loki TNT TUR z


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.scuolaitaliana.edu.uy
Sending IP: 190.64.204.33
From: TNT EXPRESS <noreply@tnt.com>
Subject: TNT SEVKİYAT BİLDİRİMİ
Attachment: TNT TARİFİ_pdf.z (contains "TNT TARİFİ_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dcb87f3395dfaf9e269adba3a1e4d4131b1a9a5a2144b097a9ea32bb50337939/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-03 12:42:06 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3s4h6m4v36xz4ju23or2dzgucmnrvgs2efclbf5j5izlwubtpe4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z dcb87f3395dfaf9e269adba3a1e4d4131b1a9a5a2144b097a9ea32bb50337939

(this sample)

Loki

Executable exe 0d78a8f492fe38d77f142c41284771dfda83b2f2856e0a850260235ffb8b6e22

  
Dropping
MD5 ca65241c8ed28056a6edde07f49abd60
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0d78a8f492fe38d77f142c41284771dfda83b2f2856e0a850260235ffb8b6e22

Comments