MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb37c24085b13cc03f636511992948aea82f5b39e7c31bf530f6f0527bd171e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb37c24085b13cc03f636511992948aea82f5b39e7c31bf530f6f0527bd171e3
SHA3-384 hash: 41843d5a6cadb9762e8d947bf2c4e2b52eda378aebda6aab9cfb57d7aafaa926fc7f53a0dc29f962819ecdf0f1950427
SHA1 hash: 76a9e5efc881ff24c7852fee0d172bd25e68c2a5
MD5 hash: 859a08fd168d9709cffb12eef00349c4
humanhash: music-low-dakota-helium
File name:Original Invoice_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:312'214 bytes
First seen:2020-10-15 12:05:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:TkASEe9dBuk1RxpqqBSvMPAeQfInKHTH+ADIj8/kTfHT/:TcEU3/rpqgIAMTe6V0HT/
TLSH 9E6423F8E3F3B4445B1E729412CFA175AAA1C4701ADBD21FCF4F7A16154622AD4A83BC
Reporter abuse_ch
Tags:gz Loki TNT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: xbx0.527.fdion.ml
Sending IP: 159.89.105.204
From: TNT EXPRESS <Airene.Jovellanos@tnt.com>
Subject: Consignment Notification: You Have A Package With Us
Attachment: Original Invoice_pdf.gz (contains "Original Invoice_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eb37c24085b13cc03f636511992948aea82f5b39e7c31bf530f6f0527bd171e3/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 12:07:07 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5m34eqefwe6map3dmuizskkiv2uc6wzz47brx5jq63yfe66rohrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eb37c24085b13cc03f636511992948aea82f5b39e7c31bf530f6f0527bd171e3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip eb37c24085b13cc03f636511992948aea82f5b39e7c31bf530f6f0527bd171e3

(this sample)

Loki

Executable exe 5a92e3b84f322216db9123b7a2bff5b1669d981add700ceb6fb690c8c08ca5bc

  
Dropping
MD5 0ccf4e8a78fa821ac23dd92879766bc4
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5a92e3b84f322216db9123b7a2bff5b1669d981add700ceb6fb690c8c08ca5bc

Comments