MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e75e51691a55a402d5ea7e35e36f37fa33944ef8467ee4af88a53dfd0a7f1165. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e75e51691a55a402d5ea7e35e36f37fa33944ef8467ee4af88a53dfd0a7f1165
SHA3-384 hash: 70db816ca5fbd008c7031e5bf6f85821655b8f8adc63ca74027e99bc3bdacefb698e1a13dac7dcf4cc2e684f2f88d3c4
SHA1 hash: 43a5dec47807e69bf8e2966c6d5f5b0fcf1cf0af
MD5 hash: 5b6c283784e902bc736627be2491cbf4
humanhash: item-double-illinois-vermont
File name:Shipping Details_PDF.rar
Download: download sample
Signature Loki
Create hunting rule
File size:402'658 bytes
First seen:2020-06-16 05:08:23 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:76ZNyoaPz20e0PMmkG8EcFvhH8kdP1i8rzup80lj5LaLw18ZHbJEvKwDMc:7akz20LPMW2H8kdP1i8rqpLSZ7JEPwc
TLSH AB842386C4E34AED8A5923E909CFF26314FF6872ED0FDDB99534FB34956086826431C8
Reporter abuse_ch
Tags:Loki rar TNT


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.mitratoyotaka.co.id
Sending IP: 103.83.179.4
From: TNT Express <info@mbjenterprise-th.com>
Subject: TNT Delivery Notification: Confirm your Shipment
Attachment: Shipping Details_PDF.rar (contains "Shipping Details_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.CryptInjector
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 05:10:11 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=45pfc2i2kwsafvpkpy26g3zx7izzitxyiz7ojl4iuu672ct7cfsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar e75e51691a55a402d5ea7e35e36f37fa33944ef8467ee4af88a53dfd0a7f1165

(this sample)

Loki

Executable exe 01e0cd7efc04b8a7b08f3e863e8c3f26b8ba599ba0655663e92f8ffa76ec6a94

  
Dropping
MD5 d3e96051c9be4fdee6ac1e65bbe1ed0b
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 01e0cd7efc04b8a7b08f3e863e8c3f26b8ba599ba0655663e92f8ffa76ec6a94

Comments