MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4cf048a182542e05217141a4a16665a5434129daeb3426cea902160c798bf435. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4cf048a182542e05217141a4a16665a5434129daeb3426cea902160c798bf435
SHA3-384 hash: 878fc5a04c4f2ffe24c053dfba1abab7498e6a2b22a9aaffc739600df1004eb87ecf1072282fb6a4e323acdcc606a5b8
SHA1 hash: 685bf840c3a9da21de51fd850e04170de34d8c51
MD5 hash: be7941646827fd77ea491a7567c558c9
humanhash: oscar-potato-single-mango
File name:GUMTEC-KOREAì— ì„œ AWB 수신 ETA 0807 G.W 18.60 kg net ë‚©í’ˆ.gz
Download: download sample
Signature Loki
Create hunting rule
File size:197'336 bytes
First seen:2020-07-16 07:17:41 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 3072:y7CvOTz5zHGaVBDMSBVFhcCPriboH6kwPwHww5v8pYeC0a/9M0wiqE4H5aG08I:y7CmmaVhnJribW6iQ0Up50w5SGG
TLSH 961422C1221149F74F4F927A01CE691335AFC3E5B2ADF674470E89B30E046A872B6A73
Reporter abuse_ch
Tags:DHL geo gz KOR Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: dhl.com
Sending IP: 45.137.22.108
From: korea DHL Express <dhlcnsendreq6@dhl.com>
Subject: [DHL]AWB Incoming (ETA 08/07 G.W 18.60 kg/net ) Delivery from GUMTEC-KOREA
Attachment: GUMTEC-KOREAì— ì„œ AWB 수신 ETA 0807 G.W 18.60 kg net ë‚©í’ˆ.gz (contains "GUMTEC-KOREAì— ì„œ AWB 수신 (ETA 0807 G.W 18.60 kg net) ë‚©í’ˆ.exe")

Loki C2:
http://boeschboddenspies.com/server/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4cf048a182542e05217141a4a16665a5434129daeb3426cea902160c798bf435/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 07:19:08 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jtyerimckqxakilrigskcztfuvbucko25m2cntvjailay6ml6q2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 4cf048a182542e05217141a4a16665a5434129daeb3426cea902160c798bf435

(this sample)

Loki

Executable exe 0bfa0a1210892f7fef260ec1090df1ebf6d0d7b1cb607d19e8b5d791aeb157d8

  
Dropping
MD5 a07faa4a118401c76a4a132640d0aa4a
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0bfa0a1210892f7fef260ec1090df1ebf6d0d7b1cb607d19e8b5d791aeb157d8

Comments