MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d833d41ebac00ff2a607e99afc18cb3f86df66fdc57345180b82df6b65197b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d833d41ebac00ff2a607e99afc18cb3f86df66fdc57345180b82df6b65197b2
SHA3-384 hash: f89a9d78f1777be035a4f3b941f149147b9392a6925800ef0280da83d595df58cbb5123b1926dde953b7146168471d12
SHA1 hash: 568306f551a437bbb2ad3b74b62a63c176043cf1
MD5 hash: 65a2753e318e48f3b776fecffba59f4a
humanhash: lion-yankee-twelve-carolina
File name:8_04_2020_9697_20200729161753_3546876.gz
Download: download sample
Signature Loki
Create hunting rule
File size:542'370 bytes
First seen:2020-08-04 10:15:06 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:5kgigmw7fRu69Cl9wtv9S5xciSG6Q6OP6Z5ORu1YD0NFZDcZ/2sqk:5kgig5ksCle7uci3hQZ4Q7fiQsz
TLSH 96B423673484930E6361E0FA3CCC8B5023ED426699E7E8B0BB8D5D43697E61B0F5DB19
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

From: Credit Europe Bank <crediteurope@crediteurope.com.ua>
Subject: absacciai.it // SWIFT
Attachment: 8_04_2020_9697_20200729161753_3546876.gz (contains "8_04_2020_9697_20200729161753_3546876.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3d833d41ebac00ff2a607e99afc18cb3f86df66fdc57345180b82df6b65197b2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 10:17:05 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hwbt2qplvqap6ktap2m27qmmwp4g35tp3rltiumaxaw7nnsrs6za._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3d833d41ebac00ff2a607e99afc18cb3f86df66fdc57345180b82df6b65197b2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 3d833d41ebac00ff2a607e99afc18cb3f86df66fdc57345180b82df6b65197b2

(this sample)

Loki

Executable exe 7708c997aff71d37d1f1ccf9244e31f34ebc128a58709c7481a1416e5d06a525

  
Dropping
MD5 80def53e8ee5e18a22ee058be281aef3
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7708c997aff71d37d1f1ccf9244e31f34ebc128a58709c7481a1416e5d06a525

Comments