MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f94e615cb180b9548c7e0ac26547f63975dbe931e09b8078609189af8aeef04d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f94e615cb180b9548c7e0ac26547f63975dbe931e09b8078609189af8aeef04d
SHA3-384 hash: 2f6c2d7dc0752075f5c3feb97239951ea44efc1464b2b9f3ed14053ffe0b66897e0ca67ed2ba6eed6d6e59a7990d8ae0
SHA1 hash: 8099534cc8eb7235179265eedb4a580ff561696c
MD5 hash: 5c8cfdaa25cf1a22d0496e62d765e785
humanhash: green-sweet-william-autumn
File name:file_xls.cab
Download: download sample
Signature Loki
Create hunting rule
File size:331'378 bytes
First seen:2020-08-31 10:33:05 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:77mqDDoqh6JZH2R7LOmAgiScERlu9pTvkZM/10bn6Ic+dmMRGHRfn2j/pyN/1a:77Hh4Zc7pdbDu9pTj2b6IdmMEHRf0gk
TLSH 81642375D1E7B6281AC01B2739C52CEB5B1C82337FA88804D4E6B99F7F0E1D6AB76540
Reporter abuse_ch
Tags:cab geo KOR Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail-smail-vm45.hanmail.net
Sending IP: 203.133.180.233
From: 전명오 <sinwol7282@daum.net>
Subject: 견적 의뢰 -토탈엠에이티(주)-
Attachment: file_xls.cab (contains "quote.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.Trojan-7.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f94e615cb180b9548c7e0ac26547f63975dbe931e09b8078609189af8aeef04d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 02:26:45 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7fhgcxfrqc4vjdd6blbgkr7whf25x2jr4cnya6dasge27cxo6bgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f94e615cb180b9548c7e0ac26547f63975dbe931e09b8078609189af8aeef04d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab f94e615cb180b9548c7e0ac26547f63975dbe931e09b8078609189af8aeef04d

(this sample)

Loki

Executable exe b8beefc7d3730abcd148e86f060de68099c1a1d701efc3d8057776ccfd062541

  
Dropping
MD5 4503c39aecd33c46bccc97250881b3de
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b8beefc7d3730abcd148e86f060de68099c1a1d701efc3d8057776ccfd062541

Comments