MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1cb88dac77d67529ee46cbebb8ccf5e1fc872d4c703d4b6ece53e23f7baf5c3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1cb88dac77d67529ee46cbebb8ccf5e1fc872d4c703d4b6ece53e23f7baf5c3f
SHA3-384 hash: 1eea92abbc49a0689794bba4d77201d8a0be26847b2e283ac5170cfd8af34243bc037517fb430be49fc95073252a9314
SHA1 hash: 978f994b5de43928a0145e4a77179f4a65a6bc9a
MD5 hash: 4fb3a9c5bce96a2347c26cd643356fa5
humanhash: leopard-uranus-king-winter
File name:436G67876.pdf.zip
Download: download sample
Signature Loki
Create hunting rule
File size:641'645 bytes
First seen:2020-11-18 13:37:39 UTC
Last seen:2020-11-27 10:10:41 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:V4Zn4v6svws5DGpcjdALHisV+QluChWRiJAuLEYmmJBAvTJMctEdnunwZ:V4e9wIDGpcjdALhXllAu9MvTJMvnIk
TLSH 62D433CD755529FCB532BA29B96F40EC0C091DD2BD84710AC24B7E67023BADBA174DB2
Reporter GovCERT_CH
Tags:Loki

Intelligence

File Origin
# of uploads :
32
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1cb88dac77d67529ee46cbebb8ccf5e1fc872d4c703d4b6ece53e23f7baf5c3f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 13:38:04 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ds4i3ldx2z2st3sgzpv3rthv4h6iolkmoa6uw3wokprd665plq7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 1cb88dac77d67529ee46cbebb8ccf5e1fc872d4c703d4b6ece53e23f7baf5c3f

(this sample)

Loki

Executable exe cdad1029a3f36aa41e87c865f9d1874cb2628913fd1415dccb6619029bca6039

  
Dropped by
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cdad1029a3f36aa41e87c865f9d1874cb2628913fd1415dccb6619029bca6039
  
Dropping
MD5 a6e74a614298eef217c696d75d8463a2

Comments