MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b80898936bb7110f0d90075072a1ace5522ff69c708061f2c4634b84e6c72b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b80898936bb7110f0d90075072a1ace5522ff69c708061f2c4634b84e6c72b3
SHA3-384 hash: eac9b8c3979a5444f432e10a4abe72cdec46cff1ccafff7dde07b67f27ff7ef0dd0950a9beadab36e58204bd7a3e0248
SHA1 hash: 8c82149002d0fd2feacf690ef3cb563fc7421c35
MD5 hash: d6d28b7cf520d3616b1fb587e5e9ebf0
humanhash: blossom-orange-earth-angel
File name:IVHQ2201800000512.zip
Download: download sample
Signature Loki
Create hunting rule
File size:344'416 bytes
First seen:2020-07-29 05:33:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:P4J5dO98bHcdfAIuIIl3L+llvKkg71r2k10w8vHAGhGUrprBqG4:P4J5Q98jcuIaSljg7gk1kvgGPpVqG4
TLSH D57423CA768E878C417C43D3835836BB51848D5D91E39604AF27F0A37F38DAA1A467E6
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: pkz37-4-spamexpert2.hoster.kz
Sending IP: 185.113.132.23
From: zpk_nii@rniiot.kz
Subject: *Overdue* payment follow up-3rd Reminder- IV HQ2201800000512
Attachment: IVHQ2201800000512.zip (contains "IVHQ2201800000512.exe")

Loki C2:
http:/beckhoff-th.com/kon/kon2/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7b80898936bb7110f0d90075072a1ace5522ff69c708061f2c4634b84e6c72b3/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 05:35:07 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=poaitcjwxnyrb4gzab2qokq2zzksf73jy4eamhzmiy2lqttmokzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/7b80898936bb7110f0d90075072a1ace5522ff69c708061f2c4634b84e6c72b3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 7b80898936bb7110f0d90075072a1ace5522ff69c708061f2c4634b84e6c72b3

(this sample)

Loki

Executable exe 8288d5fdb5a00ad36980616a12f75316753339bb553353008a526545ee21b5f9

  
Dropping
MD5 a7be56c01293b4a4290e0a035fb93dd7
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8288d5fdb5a00ad36980616a12f75316753339bb553353008a526545ee21b5f9

Comments