MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a08421650ef429458da02554205742b1d794e224e279f608db5ae8c3ff02b19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a08421650ef429458da02554205742b1d794e224e279f608db5ae8c3ff02b19
SHA3-384 hash: d33408a2a8acbb289aecfc6631bfa8a5c7651d96ae71932781caf0182c38d06b9d3c42c1f8875b4e6066263b29cbc99c
SHA1 hash: 5fda32f8e59423ebc7d7ec9abb3d02199a67e797
MD5 hash: 25c0a6ec91dd6fc4a0047b419f212d55
humanhash: freddie-sodium-north-uniform
File name:Shipping_Documents_doc.arj
Download: download sample
Signature Loki
Create hunting rule
File size:199'958 bytes
First seen:2020-07-21 06:47:59 UTC
Last seen:2020-07-24 12:12:39 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:QC8tvW6L7XQLnU/kUvaQLEmc3gCtJO4yV/TCSI7lj9EKY:GtL7gz/QJqgCm3V/eS4jW
TLSH 83141247ED20DAAD6FA4AA5FEC56B1786B3D08532B57AB5FC898344C1481A01C3CDCED
Reporter abuse_ch
Tags:arj Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: server9.acidados.net
Sending IP: 176.221.34.180
From: balamurugan@consilium.ae
Subject: RE: Order No : 00067306900116161 (MT. HEDY)
Attachment: Shipping_Documents_doc.arj (contains "Shipping_Documents_doc.exe")

Loki C2:
http://flexpak-th.com/osama/aboki/fre.php

Intelligence

File Origin
# of uploads :
6
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25081.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7a08421650ef429458da02554205742b1d794e224e279f608db5ae8c3ff02b19/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 00:58:01 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pieeefsq55bjiwg2ajkueblufmoxstrcjytz6yenwwxiyp7qfmmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7a08421650ef429458da02554205742b1d794e224e279f608db5ae8c3ff02b19

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 7a08421650ef429458da02554205742b1d794e224e279f608db5ae8c3ff02b19

(this sample)

Loki

Executable exe b3a7d7259f281fc136bbb9c8e364ba1b35cd517259c0b0ce73eef4b2b98b03b3

  
Dropping
MD5 c4b9bdcb2b783a491d8e421b82ee19f6
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b3a7d7259f281fc136bbb9c8e364ba1b35cd517259c0b0ce73eef4b2b98b03b3

Comments