MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 397869edf764e26181a0047b661db184ab4eef20ffc71fd2c4a854cf80168c90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 397869edf764e26181a0047b661db184ab4eef20ffc71fd2c4a854cf80168c90
SHA3-384 hash: eb97a3b9f305bd5fc8568f4dc9e27ddc8ab6a03e36ac36962fc8b48d0442f786cc4575afb78076a159d52e585f1e82a8
SHA1 hash: f2d0b11f76009a0eeb9b000d01b1ab013de5d852
MD5 hash: d9c381dafbfa463e1c404d613e95b4db
humanhash: stream-bacon-three-louisiana
File name:견적 제출건(저스트)HYUNDAI MASS QUARANTREAT PROJECT.dwg.7z
Download: download sample
Signature Loki
Create hunting rule
File size:447'375 bytes
First seen:2020-08-28 05:59:14 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:+H5BGstuQ1ACGCzdPtZ1m1kp4aCYKaQEAmtHt/xtOy1hqdRQ9QtebpRHWrCneF:IBGstn7bZZwYEEZN/jz1huBebpR2OneF
TLSH 3F9423E060D1DB99F477402DD61358B738223CA26B73978DAE3E37D10192EDA4622F5E
Reporter abuse_ch
Tags:7z geo KOR Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail-smail-vm88.hanmail.net
Sending IP: 211.231.106.163
From: 이규철 <kimsy9444@hanmail.net>
Subject: 견적
Attachment: 견적 제출건(저스트)HYUNDAI MASS QUARANTREAT PROJECT.dwg.7z (contains "견적 제출건(저스트)HYUNDAI MASS QUARANTREAT PROJECT.dwg.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/397869edf764e26181a0047b661db184ab4eef20ffc71fd2c4a854cf80168c90/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-28 06:01:06 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hf4gt3pxmtrgdanaar5wmhnrqsvu53za77dr7uwevbkm7aawrsia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/397869edf764e26181a0047b661db184ab4eef20ffc71fd2c4a854cf80168c90

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

7z 397869edf764e26181a0047b661db184ab4eef20ffc71fd2c4a854cf80168c90

(this sample)

Loki

Executable exe 4ab00875960cf2aace6c95e245327e7c27ba9cde509afd927ace70756a40c0c8

  
Dropping
MD5 d20713a3da0b15c56d6de42e81774299
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4ab00875960cf2aace6c95e245327e7c27ba9cde509afd927ace70756a40c0c8

Comments