MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f89577cb263475985e9be012eabf82abeb1ac0a7dc5f355776fc00395c56c9f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f89577cb263475985e9be012eabf82abeb1ac0a7dc5f355776fc00395c56c9f0
SHA3-384 hash: bdc1e3649bc9bf990f0c1bb60ea78adbfc1d85c0f469fb600a706535215f41b05c0f97ecd26e5b3fa9bab6d49560ca99
SHA1 hash: 1d33e0688945d2cae3586382a795710084ac667b
MD5 hash: 87b0962f31a767dc99be426620c44eba
humanhash: cup-football-lemon-magnesium
File name:TNT Original Invoice_pdf.exe.gz
Download: download sample
Signature Loki
Create hunting rule
File size:226'940 bytes
First seen:2020-10-27 09:20:04 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:gQT0ttCsdt3O9Hi0MVBEW5O5hlY80A965l:ittHCi0qEWI5TYFP5l
TLSH 8C24121AF36EE7459DA0688CE8B863CE888117D11AC387154FE5F7BD569AF078CCC618
Reporter abuse_ch
Tags:gz Loki TNT


Avatar
abuse_ch
Malspam distributing Loki:

HELO: larisaevents.gr
Sending IP: 213.239.215.207
From: einvoicing <tntsupport.admin@tnt.com>
Subject: TNT Express Invoice: 09004105 - Account: 000022245
Attachment: TNT Original Invoice_pdf.exe.gz (contains "TNT Original Invoice_pdf.exe.exe")

Loki C2:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f89577cb263475985e9be012eabf82abeb1ac0a7dc5f355776fc00395c56c9f0/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 15:38:27 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ckxpszggr2zqxu34ajovp4cvpvrvqfh3rptkv3w7qadsxcwzhya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz f89577cb263475985e9be012eabf82abeb1ac0a7dc5f355776fc00395c56c9f0

(this sample)

Loki

Executable exe b524b8d67e16781462e06815013dc190be41690c8a3cfcbbb6cff09bebb7c07f

  
Dropping
MD5 cd91f2be1c7eef1bf44f3207a445b3c3
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b524b8d67e16781462e06815013dc190be41690c8a3cfcbbb6cff09bebb7c07f

Comments