MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67d2fc63fc22c0b73a312de60b8ec5e719bcd260ec1efc7710939502e94d839e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 67d2fc63fc22c0b73a312de60b8ec5e719bcd260ec1efc7710939502e94d839e
SHA3-384 hash: 9c4540e4c1e0c192687a5d614cdb39aecd73a1e367c2f3f11e3584b7e296b7427386600e54843f7bcec44c3d3019f055
SHA1 hash: 83a13339ef6b59a0ff26676f7108a143f5ae3bc3
MD5 hash: 856f6eb6c0f30290f584a4d00edc949e
humanhash: march-island-jupiter-pasta
File name:2020 08 27.cab
Download: download sample
Signature Loki
Create hunting rule
File size:341'041 bytes
First seen:2020-08-27 08:28:20 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:LeMQoYiTLz6F6SBfbDPxELm319YzNiA+9JZ+SH:y5oYiveT28QNiAIJASH
TLSH 31742326972720932F5A02F57DB0293A784C0D29FD2A36BAD409D2CC770E745CA91BDF
Reporter abuse_ch
Tags:cab Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail-smail-vm84.hanmail.net
Sending IP: 211.231.106.159
From: 비 엘 두 주 식 회 사 <skfc0404@daum.net>
Subject: 견적용입니다 긴급으로 견적만 주세요
Attachment: 2020 08 27.cab (contains "po.exe")

Loki C2:
http://79.124.8.8/plesk-site-preview/benetaeu-group.com/http/79.124.8.8/white/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.409.16758.18659.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/67d2fc63fc22c0b73a312de60b8ec5e719bcd260ec1efc7710939502e94d839e/
Threat name:
Win32.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-08-27 08:30:08 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m7jpyy74elaloorrfxtaxdwf44m3zuta5qppy5yqsokqf2knqopa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/67d2fc63fc22c0b73a312de60b8ec5e719bcd260ec1efc7710939502e94d839e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab 67d2fc63fc22c0b73a312de60b8ec5e719bcd260ec1efc7710939502e94d839e

(this sample)

Loki

Executable exe a1fc559f31c7e54a8893e1708439bc467c2a59879b6a0076ce19a91d427aa04f

  
Dropping
MD5 4db8a9bff3ca0350e33a1190f2191821
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a1fc559f31c7e54a8893e1708439bc467c2a59879b6a0076ce19a91d427aa04f

Comments