MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a338bc36401f08cd1f3be470e8c3cdec58c7b530954c37748fff59779e79d68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1a338bc36401f08cd1f3be470e8c3cdec58c7b530954c37748fff59779e79d68
SHA3-384 hash: b06d19b3af758e57b01f62617f157fbac0832bf707a3bc2724bd5ba0a8ccfb9d63e0fbd3ff1555e9c87eb67348b8464e
SHA1 hash: c042cfcfd14b8d3961fd3c357b9decdbf3b34997
MD5 hash: aaf25f3f60bfc63f41ed165006436942
humanhash: leopard-robin-mexico-sad
File name:Payment Advise_pdf.arj
Download: download sample
Signature Loki
Create hunting rule
File size:446'252 bytes
First seen:2020-10-22 07:41:58 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:YHUzNL0Lvi1eo/73/fIMsHugPp93u4z+FygAueX:XBkvit/73/fIM41p9e4z+FuPX
TLSH 12942363DD09CB45E73D35926449FA6640F2998C18EEA8E33E8273937ECC367254924F
Reporter abuse_ch
Tags:arj Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: ermis.hcg.gr
Sending IP: 84.205.254.49
From: Λ/Χ ΣΑΡΩΝΙΚΟΥ <saronikos@hcg.gr>
Subject: SUBJECT:Advice from Standard Chartered Bank
Attachment: Payment Advise_pdf.arj (contains "Payment Advise_pdf.exe")

Loki C2:
http://magicview.ga/choolee/gate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1a338bc36401f08cd1f3be470e8c3cdec58c7b530954c37748fff59779e79d68/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 02:56:29 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dizyxq3eahyizuptxzdq5db433cyy62tbfkmg52i772zo6phtvua._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

arj 1a338bc36401f08cd1f3be470e8c3cdec58c7b530954c37748fff59779e79d68

(this sample)

Loki

Executable exe c42589d2d88a04d7fb74e4e4fa24457d912a2e263ae583c4a1126dec475046b2

  
Dropping
MD5 3e7ab76b80a59ef37e1503605408edd7
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c42589d2d88a04d7fb74e4e4fa24457d912a2e263ae583c4a1126dec475046b2

Comments