MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 307beb94f23691fec0df2fdbd193e1280dc610e5fc5bafe6550f6d20f0d574dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 307beb94f23691fec0df2fdbd193e1280dc610e5fc5bafe6550f6d20f0d574dd
SHA3-384 hash: 488f0623e2280a56672f7406402c59f6bb8544e324a0a39f1e2c9d8b446f3740bc4e2405d0457a9cee6c1abc8ff7edf8
SHA1 hash: bbe61f2c80a05608dda5f491abf6855993560207
MD5 hash: aa1a0a8803313ab3a668bcfd21cc23b4
humanhash: november-hydrogen-spaghetti-nine
File name:LISTA DE MIEMBROS SUSPENDIDOS.pdf.z
Download: download sample
Signature Loki
Create hunting rule
File size:723'779 bytes
First seen:2021-01-13 20:06:16 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:5eOYFmtUUu9nOi9Sy9A80buBE+D3EkbLoOhtkGKQ+6Zr0+sKVhTD87t66vZeiUMU:hYeiOsSyEbuBE+D3FRSQ+6Zro4TD87tS
TLSH 96F4334EFB82E268FF54F4AC6E71E578113AAFB60626C0EB3354DD0260A85DFB111947
Reporter abuse_ch
Tags:Loki z


Avatar
abuse_ch
Malspam distributing Loki:

HELO: vhosts54.montevideo.net.uy
Sending IP: 200.40.79.224
From: Fideicomiso PGE-CIU <consulta@pge.com.uy>
Subject: PGE - LISTA DE MIEMBROS SUSPENDIDOS
Attachment: LISTA DE MIEMBROS SUSPENDIDOS.pdf.z (contains "LISTA DE MIEMBROS SUSPENDIDOS.pdf.exe")

Loki C2:
http://51.195.53.221/p.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/307beb94f23691fec0df2fdbd193e1280dc610e5fc5bafe6550f6d20f0d574dd/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-01-13 20:07:05 UTC
AV detection:
15 of 46 (32.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gb56xfhsg2i75qg7f7n5de7bfag4mehf7rn27zsvb5wsb4gvotoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/307beb94f23691fec0df2fdbd193e1280dc610e5fc5bafe6550f6d20f0d574dd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

z 307beb94f23691fec0df2fdbd193e1280dc610e5fc5bafe6550f6d20f0d574dd

(this sample)

Loki

Executable exe b48bedacf7e54e532d5d32aefe7e43a1fe597edd91086119765af77b5c065ed3

  
Dropping
MD5 aedfd31737c70958efe28d1006d50d20
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b48bedacf7e54e532d5d32aefe7e43a1fe597edd91086119765af77b5c065ed3

Comments