MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f57866b3557721c3beef920c6e57c67b49264624cc0e9fe099262cf64dcdb8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f57866b3557721c3beef920c6e57c67b49264624cc0e9fe099262cf64dcdb8c
SHA3-384 hash: f599e834f5a9afa0cde004b3edcbdd91b0ce3f9b0a16d686eb50269c4b90fa3279885b7543c7827e986a52ba2ced4e68
SHA1 hash: 38a42077356a8e49f237683d73ee5c7c61d33119
MD5 hash: 4761c67a0e23e735470ed305d332c90a
humanhash: wolfram-don-robin-tango
File name:Document Q112.rar
Download: download sample
Signature Loki
Create hunting rule
File size:322'953 bytes
First seen:2020-10-28 08:13:21 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Io30eLRlQf9POBePijvydNM32kNdfxYwRXEoYluKJS7yg:Io3R/QfBOBeW6vGVdfxYYXEoDKgug
TLSH E56423231C64ADF720AD1E94BA167ECD0BFB854B55077C3644F2734E1BCA5B128920E7
Reporter abuse_ch
Tags:DHL Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server.filmworld.tv
Sending IP: 70.32.31.17
From: DHL Express <dhlSender@dhl.com>
Reply-To: DHL Express <pkd.lycheu@gmail.com>, dhlSender@dhl.com
Subject: RE:DHL Goods Arrest on Order
Attachment: Document Q112.rar (contains "jpgaNqavhUuxpC5.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f57866b3557721c3beef920c6e57c67b49264624cc0e9fe099262cf64dcdb8c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-28 00:20:33 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j5lym2zvk5zbyo7o7eqmnzl4m62jezdcjtaot7qjsjrm6zg43oga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 4f57866b3557721c3beef920c6e57c67b49264624cc0e9fe099262cf64dcdb8c

(this sample)

Loki

Executable exe 6ba4aafa0334ac89d2f46481dfdbb3678e7cb1a3fc4c223675fc154a6c864ba7

  
Dropping
MD5 6fbeb9ed3c127c48608a1ce9ead3c95e
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6ba4aafa0334ac89d2f46481dfdbb3678e7cb1a3fc4c223675fc154a6c864ba7

Comments