MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01f183f4e0112ce8216fc8584325721255013a278e4612635dab8f6c4f2604fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 01f183f4e0112ce8216fc8584325721255013a278e4612635dab8f6c4f2604fc
SHA3-384 hash: b4cf5f6ef73a03fd773626d1df87feffcedd594d248f6b7b45ab4f7e01235d388643b3f633a3156e7ce5a578405c9ec5
SHA1 hash: c70ce47e040c93fbd1442611943e4acf9cb2d53d
MD5 hash: 4dfa6bcd767d6e3e0415eec8d85594eb
humanhash: potato-table-virginia-mars
File name:COS1102213211.gz
Download: download sample
Signature Loki
Create hunting rule
File size:380'396 bytes
First seen:2020-10-13 05:47:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:r/tBC+vs5hPN4/mp9l0ezDRdJep+dg7+WgBvA/xKspQnC/3BDU62MAz3gPx:7tg+v4l170a1djOu+Zz9vb2MAzQPx
TLSH 268423CD0F42304585DC8654A6319F582BB226C6FB138DCBAD23C19777E3AD8E66C95C
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: iix63.rumahweb.com
Sending IP: 103.247.9.14
From: COSCO Shipping Co., Ltd. <indah@iec-ind.co.id>
Subject: RE: Pending Invoice payment (COSCO CN)
Attachment: COS1102213211.gz (contains "COS1102213211.exe")

Loki C2:
http://future--seafood.com/kaka/kaka1/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/01f183f4e0112ce8216fc8584325721255013a278e4612635dab8f6c4f2604fc/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 01:42:21 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ahyyh5hacewoqilpzbmegjlscjkqcorhrzdbey25vohwytzgat6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/01f183f4e0112ce8216fc8584325721255013a278e4612635dab8f6c4f2604fc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 01f183f4e0112ce8216fc8584325721255013a278e4612635dab8f6c4f2604fc

(this sample)

Loki

Executable exe 7d2de8ad52206903337b1671c205238cc31d868de8dc05ea193f126b29f0eaae

  
Dropping
MD5 95c0f1a2681de979e11cf8f26425a4bd
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7d2de8ad52206903337b1671c205238cc31d868de8dc05ea193f126b29f0eaae

Comments