MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c227caf9a081c4b659a21b259b15b40377f722a73292f226ca2d2e5135579242. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c227caf9a081c4b659a21b259b15b40377f722a73292f226ca2d2e5135579242
SHA3-384 hash: 756e4123f820bc144a5afe7726b14e7389d90cdecc591f32a1f4e81f133b4f6693f25574e90a35c11e33cfad973e493c
SHA1 hash: ec38f00bedd6476fdfc7a052288364df70cc0240
MD5 hash: 0547402792703888d38bac222a558d05
humanhash: maryland-yankee-kilo-colorado
File name:2894PO-146.xls.gz
Download: download sample
Signature Loki
Create hunting rule
File size:146'960 bytes
First seen:2020-08-06 05:49:33 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 3072:+035NM2fLg34ZZw/NUt02cEq30zNC1GIjIt8whjBjbOSyxwBYjfrz2v:Rpi2fLgCm/qtGLJIm2jBjdyxwBYjO
TLSH 14E323CA7E77682FC100D91FCB11D437D3B12BBA7EB5113766322DE94483EB69126A81
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: zenhb.superhosting.bg
Sending IP: 164.138.219.11
From: Helmut Bernard <helmut.bernard@rhomberg.com>
Subject: Rhomberg Bau GmbH / [Purchase Order 2894PO-146]
Attachment: 2894PO-146.xls.gz (contains "2894PO-146.xls.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c227caf9a081c4b659a21b259b15b40377f722a73292f226ca2d2e5135579242/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:51:07 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yit4v6naqhclmwncdmszwfnuan37oivhgkjpejwkfuxfcnkxsjba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
0.70
Link:
https://yomi.yoroi.company/submissions/c227caf9a081c4b659a21b259b15b40377f722a73292f226ca2d2e5135579242

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz c227caf9a081c4b659a21b259b15b40377f722a73292f226ca2d2e5135579242

(this sample)

Loki

Executable exe 6d9c4aa0d5dd0a772adfea51ed3fe61ce25cfe079d91353cd7516cc972c9cf70

  
Dropping
MD5 4cdf878fd47a568737efe0b4d0cd6fa0
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6d9c4aa0d5dd0a772adfea51ed3fe61ce25cfe079d91353cd7516cc972c9cf70

Comments