MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 795af8a5cb2b432cd988410d43e81b581c0538f1c077a4195e9bc504aeeafcf0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 795af8a5cb2b432cd988410d43e81b581c0538f1c077a4195e9bc504aeeafcf0
SHA3-384 hash: 23fb980a1589ad6ba3b16d7c8d41fc3398868f872085433c4219c051b49b2301d83a9ab29d582ee856c36289af6bff80
SHA1 hash: a56f008268f9e9e18768c2cb71a33ae518e5cfc6
MD5 hash: 162862c17b90646aab1bb7c78b8deb37
humanhash: washington-william-ten-four
File name:Shipping_Document_pdf.arj
Download: download sample
Signature Loki
Create hunting rule
File size:363'004 bytes
First seen:2020-12-08 16:38:14 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:wmYtRmu04K8EaUE3ZPGtSMGX0Q+7jyWbsPIyqaWFKqH/iE9Ikgpz05gil:wztRmuZEaNRcSMNfpwZWXH/iuHh5X
TLSH 2C7423692917C978E830DB2253A3AA0C5D38370D6DCEEDA673718A67BC7C1E416836C5
Reporter abuse_ch
Tags:arj Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: slavesmtp.scs-net.org
Sending IP: 213.178.226.243
From: SARAH ZAYED <sarah.sonhuang@master-agency.com.cn>
Subject: SHIPPING DOCUMENT_PDF DHL#6389434225, PL,CI
Attachment: Shipping_Document_pdf.arj (contains "Shipping_Document_pdf.exe")

Loki C2:
http://forrastfoods.com/canna/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
163
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_badexts14.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/795af8a5cb2b432cd988410d43e81b581c0538f1c077a4195e9bc504aeeafcf0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-08 16:39:04 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pfnprjolfnbszwmiieguh2a3laoakohryb32igk6tpcqjlxk7tya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/795af8a5cb2b432cd988410d43e81b581c0538f1c077a4195e9bc504aeeafcf0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 795af8a5cb2b432cd988410d43e81b581c0538f1c077a4195e9bc504aeeafcf0

(this sample)

Loki

Executable exe a2faafe17f1c5486ce97238fa62db005afd9af7b53b1d15672c098db19129346

  
Dropping
MD5 18109bcdbfd0bc8a847d48610cd572f2
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a2faafe17f1c5486ce97238fa62db005afd9af7b53b1d15672c098db19129346

Comments