MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08f70b478d45a26f9ed88ee584b1b91ecd7c77618c4b62e2354bebdb9bb71c16. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08f70b478d45a26f9ed88ee584b1b91ecd7c77618c4b62e2354bebdb9bb71c16
SHA3-384 hash: 033cba06479ce167bda6f2a50ccfd1c293f732a6d643257f37f9c39da3317fdf1d096d6578549501f073dd3a37af5f20
SHA1 hash: 4b699b096601f1f2f431ed739525352eb0489604
MD5 hash: eda6f80c1a558aaa4385b36ea442a664
humanhash: queen-salami-timing-item
File name:MTRV03KV.cab
Download: download sample
Signature Loki
Create hunting rule
File size:487'723 bytes
First seen:2020-07-20 09:12:48 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:tSSkUZIlVeE3U0q9LSX01eWBi+jaRmtz3+qK0Uzmhw9:p1elvU0qQX6eEiyzcL79
TLSH 93A42316CAC6C5A04DA8671AA09DD030A44634DFED036B49C2DFDE94F4CA3B97019FEB
Reporter abuse_ch
Tags:cab geo KOR Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail-smail-vm40.hanmail.net
Sending IP: 203.133.180.228
From: 이선아 <lsa930@daum.net>
Subject: 견적요청의 건Mitsubishi.Japan
Attachment: MTRV03KV.cab (contains "MTRV03KV.exe")

Loki C2:
http://79.124.8.8/plesk-site-preview/akinsab.ru/http/79.124.8.8/garuba/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/08f70b478d45a26f9ed88ee584b1b91ecd7c77618c4b62e2354bebdb9bb71c16/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 09:14:07 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bd3qwr4niwrg7hwyr3syjmnzd3gxy53brrfwfyrvjpv5xg5xdqla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/08f70b478d45a26f9ed88ee584b1b91ecd7c77618c4b62e2354bebdb9bb71c16

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab 08f70b478d45a26f9ed88ee584b1b91ecd7c77618c4b62e2354bebdb9bb71c16

(this sample)

Loki

Executable exe 661fb4962c61302ab8628cb068a019f8292f8e225300be1592d9d499f34c2d32

  
Dropping
MD5 53106dacc2c8339af80cdf24ce5318c7
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 661fb4962c61302ab8628cb068a019f8292f8e225300be1592d9d499f34c2d32

Comments