MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29985d425c2519f588f744150b8107a38b3317fedf9f4420dc7cad81b59cb449. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29985d425c2519f588f744150b8107a38b3317fedf9f4420dc7cad81b59cb449
SHA3-384 hash: 4d307503c3e95f7edd1f154fb25373740e9d732831cc219bc9ad652d204d1274dfeb44961765e6fdf2f0478b57545973
SHA1 hash: 8090d0c7032f834783de1e0ccf9795b469aecd46
MD5 hash: d306720fb2b91a933b7fe999bee8b333
humanhash: eight-ack-lake-hamper
File name:HSBC_pdf.zip
Download: download sample
Signature Loki
Create hunting rule
File size:398'882 bytes
First seen:2021-03-01 10:44:06 UTC
Last seen:2021-03-10 03:07:13 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:B/OuKKilNUoH8K9zu72PXjJb92yk2PAL0Hqk0GUyOPK:ouN2NUocmaM2iRUyoK
TLSH B984236B742BA5C951BA41DD9583ED247A340B8C36E33337F9C74B1A32C556EC1CB88A
Reporter GovCERT_CH
Tags:Loki

Intelligence

File Origin
# of uploads :
13
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Malware.AI.4244240854.22492.13300.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/29985d425c2519f588f744150b8107a38b3317fedf9f4420dc7cad81b59cb449/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-01 09:13:02 UTC
AV detection:
11 of 47 (23.40%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fgmf2qs4eum7lchxiqkqxaihuoftgf7636puiig4pswydnm4wreq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/29985d425c2519f588f744150b8107a38b3317fedf9f4420dc7cad81b59cb449

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 29985d425c2519f588f744150b8107a38b3317fedf9f4420dc7cad81b59cb449

(this sample)

Loki

Executable exe c4ae9554d78e411790c76fbfd27ac61ea7fd9cdd058893cd36dd5d16855e1140

  
Dropped by
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c4ae9554d78e411790c76fbfd27ac61ea7fd9cdd058893cd36dd5d16855e1140
  
Dropping
MD5 65773ac1a060e4cba3dac8e9f69a3965

Comments