MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56ea386dac82a0a94d61ee78b65ececf9a092689d26355e2e135481ad167e085. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56ea386dac82a0a94d61ee78b65ececf9a092689d26355e2e135481ad167e085
SHA3-384 hash: da3572461e40d9745ba1634ca1229a8f18dfced03d8af8f08add18f2f556e03b77803cd30d7c746312fc321088876782
SHA1 hash: 3c50fd193520dad11801db0b86b1375f83f2d8b0
MD5 hash: ae2c04d603ba8add81ce37615845bb55
humanhash: solar-georgia-edward-golf
File name:Conan Fegan - Aluminium.gz
Download: download sample
Signature Loki
Create hunting rule
File size:282'179 bytes
First seen:2021-02-22 20:28:28 UTC
Last seen:2021-02-23 06:41:40 UTC
File type: gz
MIME type:application/gzip
ssdeep 6144:X1LQJSuNoACqXm+IpCJTJ/hQSRQJqaFnZ0YfnON+KgxGf:5QeqW+IgJphQK2REYfnPKZ
TLSH BD5423FDD954879684CEF18518C83F9750216F1BD259B75B8B72FE3AC087CB4026782A
Reporter cocaman
Tags:gz Loki


Avatar
cocaman
Malicious email (T1566.001)
From: "Erin - Lynch Windows <erin@lynchwindows.ie>" (likely spoofed)
Received: "from nomikos.gr (unknown [45.137.22.49]) "
Date: "22 Feb 2021 19:05:51 -0800"
Subject: "E3713Q Conan Fegan - Aluminium Enquiry"
Attachment: "Conan Fegan - Aluminium.gz"

Intelligence

File Origin
# of uploads :
4
# of downloads :
125
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Outbreak.12739.1100.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/56ea386dac82a0a94d61ee78b65ececf9a092689d26355e2e135481ad167e085/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-22 20:29:05 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
11 of 47 (23.40%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k3vdq3nmqkqkstlb5z4lmxwoz6nasjuj2jrvlyxbgvebvulh4ccq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/56ea386dac82a0a94d61ee78b65ececf9a092689d26355e2e135481ad167e085

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 56ea386dac82a0a94d61ee78b65ececf9a092689d26355e2e135481ad167e085

(this sample)

Loki

Executable exe f1a43d8b49bda3c88eb1c314c9460a92c0b467ea8db4c9086ac8e3bfe358e511

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f1a43d8b49bda3c88eb1c314c9460a92c0b467ea8db4c9086ac8e3bfe358e511
  
Dropping
Loki
  
Dropping
MD5 708ee64939578fbb07010e20f6c7672c

Comments