MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 920c0b38c72ffe80aea46ee0614d82d0667e359cac147f207b68e57b369ab1cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 920c0b38c72ffe80aea46ee0614d82d0667e359cac147f207b68e57b369ab1cf
SHA3-384 hash: fc5e131eff372dbc01d0ec322e0bd7e2f04a4b27d674610911fcced4ed383349d1f444518052f1e8b6acfa471471aca0
SHA1 hash: 2fca844b133fa1b40c12d05971a765901d408131
MD5 hash: 64e6d0e8a0d1fcbad7338b53dbdc4cb5
humanhash: eight-wyoming-green-hotel
File name:Purchase-Order-PO-7106314-Quotation,xlxs.z
Download: download sample
Signature Loki
Create hunting rule
File size:212'295 bytes
First seen:2020-07-21 07:34:36 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:AbSCCQqnY2t7laCT+rPNU3nm8l9yO4EmJCV59k4PQf:AbSrQqPbaq+7N0nmwyhHCH9DPQf
TLSH 792423818ABE76745D03181EB797CC8B36DB78DBE3FA88569FE0BD502197040812DF29
Reporter abuse_ch
Tags:Loki z


Avatar
abuse_ch
Malspam distributing Loki:

HELO: als.sparkmail.jp
Sending IP: 202.233.10.33
From: 조형호 <cho15776507@daum.net>
Subject: 견적 요청 (친절하게 견적)
Attachment: Purchase-Order-PO-7106314-Quotation,xlxs.z (contains "Purchase-Order-PO-7106314-Quotation,xlxs.exe")

Loki C2:
http://emirate-net.me/phazzyitalian/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/920c0b38c72ffe80aea46ee0614d82d0667e359cac147f207b68e57b369ab1cf/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 07:36:08 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sigawoghf77iblven3qgctmc2bth4nm4vqkh6id3ndsxwnu2whhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/920c0b38c72ffe80aea46ee0614d82d0667e359cac147f207b68e57b369ab1cf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z 920c0b38c72ffe80aea46ee0614d82d0667e359cac147f207b68e57b369ab1cf

(this sample)

Loki

Executable exe 7985804e27ef80e2dbf7bafc62ca022f600ceb1b9f636a90d0e3826eb2aeb978

  
Dropping
MD5 4bdc54d3c7b39799c2bdf546139b4a45
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7985804e27ef80e2dbf7bafc62ca022f600ceb1b9f636a90d0e3826eb2aeb978

Comments