MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16ec3325e36002e1e676e7f17a354a59fff614493cfe5fb00548c4334b4f410f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 16ec3325e36002e1e676e7f17a354a59fff614493cfe5fb00548c4334b4f410f
SHA3-384 hash: 39a544b2c51879b007d35513c45f8830d8699e87188c49bbfc0d43eeaf6af5193e37a85d98570b56e80e9297b60b6cbb
SHA1 hash: b058815125cc619189230e196e87b1e2b7403fcd
MD5 hash: f29a36abef6f99c407acd2150b953993
humanhash: mirror-ten-lima-virginia
File name:PAYBT6_ISI20PAYBT30090.ISO
Download: download sample
Signature Loki
Create hunting rule
File size:1'245'184 bytes
First seen:2020-11-07 15:03:38 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:v39GWOswqGHEtEvsuQbtVHAJNB77xNLyWiG6fLfKp34U63ZIVCci1:vtFOsWUntFi/FCKpIU63ZSi
TLSH 3C45016A53889F09D5BF237C4569644123F0E299E723EB033DDC50ED2BE2B418764B9B
Reporter abuse_ch
Tags:iso Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: higherland.com
Sending IP: 89.238.176.6
From: info <info@higherland.com>
Subject: The payment ISI20PAYBT30090 has been processed and the payment issued
Attachment: PAYBT6_ISI20PAYBT30090.ISO (contains "PAYBT6_ISI20PAYBT30090.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.424.14572.19761.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/16ec3325e36002e1e676e7f17a354a59fff614493cfe5fb00548c4334b4f410f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 11:45:03 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c3wdgjpdmabodztw47yxunkklh77mfcjht7f7mafjdcdgs2piehq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

iso 16ec3325e36002e1e676e7f17a354a59fff614493cfe5fb00548c4334b4f410f

(this sample)

Loki

Executable exe 10e5bbc93b83800a83ee06a2652275091670a541f90e1b94f55e8aafacc52a48

  
Dropping
MD5 3e808f69cabfdbe039b4200bf6fa7539
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 10e5bbc93b83800a83ee06a2652275091670a541f90e1b94f55e8aafacc52a48

Comments