MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 271c7b57745f17587e5eedafe6fea147f9864eaefe88586c3aaacd8291f1bf97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 271c7b57745f17587e5eedafe6fea147f9864eaefe88586c3aaacd8291f1bf97
SHA3-384 hash: bf62f723df24c9b3d17613f141da0ed5e3d7adc822269f1d9e879f54fa283264a972dd6e155d162a38ff99a89d59422c
SHA1 hash: 8a23d07b0ff8c68ab3e3f0cfe8f668be700890f8
MD5 hash: e81fc3ebb44c117339f317bbfb0efab5
humanhash: kitten-nineteen-texas-nebraska
File name:PO.zip
Download: download sample
Signature Loki
Create hunting rule
File size:788'113 bytes
First seen:2020-12-17 08:38:30 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:Rw3FamB6SpcqiQtGKEWFwk2acbR7jyRPp:q13zpbiQBok2FSRPp
TLSH C2F42381FFEA40D221EC29871C89AA11DD14142491C3CF7E0D17EA8A2D7F775BD8DD96
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: v133-130-74-17.myvps.jp
Sending IP: 133.130.74.17
From: Ruilos@Kouei.vn
Subject: FW; PO
Attachment: PO.zip (contains "PO.exe")

Loki C2:
http://oziltestfw.ml/officem10/logs/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs1137.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21241.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/271c7b57745f17587e5eedafe6fea147f9864eaefe88586c3aaacd8291f1bf97/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-17 08:39:12 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e4ohwv3ul4lvq7s65wx6n7vbi74ymtvo72efq3b2vlgyfeprx6lq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/271c7b57745f17587e5eedafe6fea147f9864eaefe88586c3aaacd8291f1bf97

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 271c7b57745f17587e5eedafe6fea147f9864eaefe88586c3aaacd8291f1bf97

(this sample)

Loki

Executable exe 503c4213cf8547c3e4f31c34bd75960f9f2e2ba40a37ad7ca2e06e52229e44e5

  
Dropping
MD5 11670b9da96d3004eb515fa1b20962fc
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 503c4213cf8547c3e4f31c34bd75960f9f2e2ba40a37ad7ca2e06e52229e44e5

Comments