MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 861c82db718c1baa7d3f66ded83d0be32c4fc26057753eef8af44a7aa89ec87a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 861c82db718c1baa7d3f66ded83d0be32c4fc26057753eef8af44a7aa89ec87a
SHA3-384 hash: f08ad9dfa2113a189dab24016703b6c063329d62e6055aca07a6ef02c342f6ef4a399785d895407deef059253733d787
SHA1 hash: db3a8fe2da567cac07368e615bae499a26afc0fc
MD5 hash: 04c5db779079c8dffb3c0ecef4943bb2
humanhash: mobile-winter-delta-skylark
File name:R-Quotation sheets 60X1219X2438MM- xlsx.gz
Download: download sample
Signature Loki
Create hunting rule
File size:539'317 bytes
First seen:2021-01-19 07:43:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:wlLRN9YS0n4q7OCrXjWZrSo8oFIqf7ljB:wxRN9VqaCvWUdoFIqjRB
TLSH 46B423258C05E8FFC0ABD8F19BC13ED74988913726A8CB59797CC5F4E62843CAF594A1
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail.technoreactor.ml
Sending IP: 193.142.59.160
From: HKG - Meko CHENG <To389@angloeastern.com>
Reply-To: To389@angloeastern.com
Subject: RFQ -SDR REPAIRS IN NO.4 PURCHASE ITEMS HOLD INQUIRY
Attachment: R-Quotation sheets 60X1219X2438MM- xlsx.gz (contains "R-Quotation sheets 60X1219X2438MM- xlsx.exe")

Loki C2:
http://mannaton.com/zoro/zoro2/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_xlsx.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/861c82db718c1baa7d3f66ded83d0be32c4fc26057753eef8af44a7aa89ec87a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 07:24:36 UTC
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qyoifw3rrqn2u7j7m3pnqpil4mwe7qtak52t534k6rfhvke6zb5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/861c82db718c1baa7d3f66ded83d0be32c4fc26057753eef8af44a7aa89ec87a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 861c82db718c1baa7d3f66ded83d0be32c4fc26057753eef8af44a7aa89ec87a

(this sample)

Loki

Executable exe d708f02908087d4a052ac20c75cb4596edbe976747bf41f9064d428e78f4d193

  
Dropping
MD5 7f4afe5b7ed87a6a7d43669403bf5ad9
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d708f02908087d4a052ac20c75cb4596edbe976747bf41f9064d428e78f4d193

Comments