MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1cf400faec86fbe987a8f681530b8b478e9f49d1085e85c4b2dc88e24d9ccab4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1cf400faec86fbe987a8f681530b8b478e9f49d1085e85c4b2dc88e24d9ccab4
SHA3-384 hash: f36d55199f899d90602de3a2e656714254ad0b42c0ef50f0e9d33976928a9eaf81393398692062408e1de560690d7e37
SHA1 hash: e254cdc5f3fbf3ad00ea907458591bf926aed838
MD5 hash: 06e2fce63dc3b669b4ce24fe2e0bfa7b
humanhash: jig-social-north-papa
File name:Swift.zip
Download: download sample
Signature Loki
Create hunting rule
File size:209'109 bytes
First seen:2020-07-11 05:58:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:wpK7rZ1J6JP0jhOCSEaYylazew+/uySYCCh:hXj0JPYNaYylggVh
TLSH D41423F572FB07D7C39990A2B58FA4CA7E5445698682003932D5DF6C8912208B97F8FF
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: utopia.herosite.pro
Sending IP: 103.108.220.126
From: accounts@kyocera.com.sg
Subject: swift copy - As requested
Attachment: Swift.zip (contains "Swift.exe")

Loki C2:
http://sportsgroup-hk.com/chief/chief2/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21516.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1cf400faec86fbe987a8f681530b8b478e9f49d1085e85c4b2dc88e24d9ccab4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-10 14:50:24 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dt2ab6xmq356tb5i62avgc4li6hj6sorbbpilrfs3seoetm4zk2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 1cf400faec86fbe987a8f681530b8b478e9f49d1085e85c4b2dc88e24d9ccab4

(this sample)

Loki

Executable exe 4b62d48e62e1049afd4571693db1e047f88a36889a38bb53188340445d4f9878

  
Dropping
MD5 5f8de689089e31366591d5e089aad91d
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4b62d48e62e1049afd4571693db1e047f88a36889a38bb53188340445d4f9878

Comments