MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7b9cb2e84d921a482daa9077abbf6bca2cddfc7fc81c51161888c0e1b40b2ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c7b9cb2e84d921a482daa9077abbf6bca2cddfc7fc81c51161888c0e1b40b2ad
SHA3-384 hash: 238f9a6f70cedf5b2e19940071a21fe01105b1ad6e0e996f2bf9d769f01e8130b0e4bab3f420935731524a9532f0c7ef
SHA1 hash: 766482a336e72c86f61b87576576933021547d87
MD5 hash: 828d9fff45376ca02ce4a17764c01e67
humanhash: fifteen-louisiana-thirteen-dakota
File name:Revised Proforma Invoice_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:448'426 bytes
First seen:2020-07-09 08:01:54 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:tSRnAPygGGCz6DKmzy3/QbJvGUiFNIySLopQg5xXvDAi77cNPivbw:tKnh8Y6DnzyPqJSN2LdgX80cN6c
TLSH 489423BF38483D55E415623A98BE0D1FEB4BCFE3B9F13AA568D72881B81121C5914BCD
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: hwsrv-740601.hostwindsdns.com
Sending IP: 104.168.165.92
From: Julie Zhang (ChinaPetro Chem Co.,Ltd)  <zeco@slokltd.us>
Subject: Re: Proforma Invoice Review And Confirmation
Attachment: Revised Proforma Invoice_pdf.gz (contains "Revised Proforma Invoice_pdf.exe")

Loki C2:
http://niskioglasi.rs/test2/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c7b9cb2e84d921a482daa9077abbf6bca2cddfc7fc81c51161888c0e1b40b2ad/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 08:02:14 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y644wlue3eq2jaw2vedxvo7wxsrm3x6h7sa4kelbrcga4g2awkwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz c7b9cb2e84d921a482daa9077abbf6bca2cddfc7fc81c51161888c0e1b40b2ad

(this sample)

Loki

Executable exe e0b5a7aa2ae1c4df12a5fa90c2f68c615690a58d80af00ff60ed5d7ab30c2f46

  
Dropping
MD5 7911d0a635c65f04715e876447a1a73d
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e0b5a7aa2ae1c4df12a5fa90c2f68c615690a58d80af00ff60ed5d7ab30c2f46

Comments