MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 334258e696ce4d58e6e37058c028c7f9ceda77111b3fff5c33ea2a6f68543983. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 334258e696ce4d58e6e37058c028c7f9ceda77111b3fff5c33ea2a6f68543983
SHA3-384 hash: 7fe4406b1319572d74b8073d29419b24a5b66ea3215e07ee3a78f1df8c745dd050f72656d40b5ec40d98a26e8743ab03
SHA1 hash: 7849bc730cfe7b7afe95c9e6d74c72a256e3dca1
MD5 hash: 15df494de6b68f9f5fb0a2522c6116a2
humanhash: mango-xray-william-bravo
File name:RFQ809018231.rar
Download: download sample
Signature Loki
Create hunting rule
File size:184'177 bytes
First seen:2020-06-24 05:31:54 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:BsNryOBN+FQ3Xe5Tr+6Zex1RcroUE6NX9Ihm3RLipfVAPycGp7E:lOxuxMFUE6EK+p/cq7E
TLSH BB04134407153D2A95D46F369BB540CEEC0C093F96E6B185FA2277CACB8C5AADC8F528
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mout.perfora.net
Sending IP: 74.208.4.197
From: Saad El-Din El-Saady <info@sulfuruae.info>
Subject: RFQ809018230 & RFQ809018231
Attachment: RFQ809018231.rar (contains "J06242020.exe")

Loki C2:
http://spqlobal.info/jeff/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/334258e696ce4d58e6e37058c028c7f9ceda77111b3fff5c33ea2a6f68543983/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-24 05:33:03 UTC
AV detection:
16 of 30 (53.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gnbfrzuwzzgvrzxdobmmakgh7hhnu5yrdm776xbt5ivg62cuhgbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 334258e696ce4d58e6e37058c028c7f9ceda77111b3fff5c33ea2a6f68543983

(this sample)

Loki

Executable exe 20c378d2a4f59908883e6fc075cd6e645ff3b326b1077a47fe0793d3fd4a1d33

  
Dropping
MD5 fbda08ff762cd04947fd7f909249dc63
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 20c378d2a4f59908883e6fc075cd6e645ff3b326b1077a47fe0793d3fd4a1d33

Comments