MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78fb63d20122a7e61d4380c284f5bfcbbd1c844e3f427309be7dd00f55883425. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 78fb63d20122a7e61d4380c284f5bfcbbd1c844e3f427309be7dd00f55883425
SHA3-384 hash: 46145f9369ed496701d02c83c2fe20c5ee95815e8baf56fc51e384b005f06c2e6b795599696195fe568ad46e6e189fc5
SHA1 hash: fad5a500ed47c31f4fcee4d3c24803da7a1c039b
MD5 hash: 9edb9e36e2c59878905ed8ba1346a561
humanhash: friend-bluebird-juliet-spaghetti
File name:PO 201012-0134A.cab
Download: download sample
Signature Loki
Create hunting rule
File size:433'806 bytes
First seen:2020-10-12 05:46:44 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:rfO0PZcK51SsiwEnnZuWqNwNJM0C3eaBcmm7g:7L5UwEn4WRLM0Oem+c
TLSH B79423C4E363583BBAE33F44D96FB54F32B75299891168FB0D2E40400DBA6266CE4F44
Reporter abuse_ch
Tags:cab geo KOR Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail-smail-vm28.hanmail.net
Sending IP: 203.133.180.210
From: 구매부 김승준 과장 <ucpn2381@daum.net>
Subject: 견적 요청
Attachment: PO 201012-0134A.cab (contains "PO 201012-0134A.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/78fb63d20122a7e61d4380c284f5bfcbbd1c844e3f427309be7dd00f55883425/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 02:50:16 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pd5whuqbekt6mhkdqdbij5n7zo6rzbcoh5bhgcn6pxia6vmigqsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/78fb63d20122a7e61d4380c284f5bfcbbd1c844e3f427309be7dd00f55883425

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab 78fb63d20122a7e61d4380c284f5bfcbbd1c844e3f427309be7dd00f55883425

(this sample)

Loki

Executable exe 95aa19eb5f26f4bc344f51d934138cb3f9a435fccb29a1d53277b06ecbb926cd

  
Dropping
MD5 f1739f1542964f8cc19a351d75e9b162
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 95aa19eb5f26f4bc344f51d934138cb3f9a435fccb29a1d53277b06ecbb926cd

Comments