MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 172dd30973ca76e6558803011d610e83d4f2f66a79b04533c636aec32b065036. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 172dd30973ca76e6558803011d610e83d4f2f66a79b04533c636aec32b065036
SHA3-384 hash: a2709fa70de59847890146f40683651aa3d8c37f6d3d8d84df0262aa4782731613d553391b03ef6209a51786ee51b1f4
SHA1 hash: 8fbf7e176b261dbbc0c0749aa8a70e5a0b5ea28a
MD5 hash: 6eb1071fd99c8fa3f1ca838f090d0f07
humanhash: sixteen-cup-angel-summer
File name:Spare RFQ-000090-1375 484969-0TQW6.gz
Download: download sample
Signature Loki
Create hunting rule
File size:701'087 bytes
First seen:2021-02-04 09:39:31 UTC
Last seen:2021-02-11 20:23:40 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:6zaoE9KMdC7GLVlLelWy6z12aMY1bq++qrfcfNtp4+MuAnL2WH1o4AuepiGo/9vU:UEIMdC7Gnrz12/YNHOy+MGWVHAun/9vU
TLSH ACE42327C9F4DEE86F5EB7272347F33B145612AE2ADCA5B8A250D8500E478D256403BF
Reporter GovCERT_CH
Tags:Loki

Intelligence

File Origin
# of uploads :
14
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.36296213.21649.9565.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/172dd30973ca76e6558803011d610e83d4f2f66a79b04533c636aec32b065036/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-04 01:06:10 UTC
AV detection:
31 of 48 (64.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c4w5gcltzj3omvmiamar2yioqpkpf5tkpgyekm6gg2xmgkygka3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/172dd30973ca76e6558803011d610e83d4f2f66a79b04533c636aec32b065036

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 172dd30973ca76e6558803011d610e83d4f2f66a79b04533c636aec32b065036

(this sample)

Loki

Executable exe 8026c043c1f755c370b8ecc74d3b7a1e9c9b009e8aea67ac65d00950c48c4744

  
Dropped by
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8026c043c1f755c370b8ecc74d3b7a1e9c9b009e8aea67ac65d00950c48c4744
  
Dropping
MD5 e483725fef5e1d1332c308343a847cd8

Comments