MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 889624e49910df884c1d72ac380aab6fb1288e58bf48b823b93ac24f68d481ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 889624e49910df884c1d72ac380aab6fb1288e58bf48b823b93ac24f68d481ee
SHA3-384 hash: 7ac6a39dbc8e1d2d3a60a1afe198c232296b1548e737d39b6eab1dddcd3a81794aa704982cb80a4216eeeacb22d08791
SHA1 hash: 6b46eeb9e228d2b1da84b04405181afd887adb0c
MD5 hash: ea135c3a020d71270e0c417ec67e4ea6
humanhash: ack-lima-cat-texas
File name:MTRV03KV.cab
Download: download sample
Signature Loki
Create hunting rule
File size:196'263 bytes
First seen:2020-07-22 09:57:39 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 3072:f8Ay4GidyjTzopxq8j7MbkVkg+k+UEyxDWzHn9c+bfHVc0M6/UXjhxesWMdtLQHo:By4KzOqIobkVkg2GDWb9cQc03sXjukZ
TLSH AB141203DC65B66865846DF472367C53EE264B1DAF8FF8B9520C88C89EA7F8C0954D34
Reporter abuse_ch
Tags:cab geo KOR Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail-smail-vm84.hanmail.net
Sending IP: 211.231.106.159
From: 신한금속 <shan0488@daum.net>
Subject: 견적요청의 건Mitsubishi.Japan
Attachment: MTRV03KV.cab (contains "MTRV03KV.exe")

Loki C2:
http://79.124.8.8/plesk-site-preview/akinsab.ru/http/79.124.8.8/garuba/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/889624e49910df884c1d72ac380aab6fb1288e58bf48b823b93ac24f68d481ee/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 09:59:05 UTC
AV detection:
18 of 27 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rclcjzezcdpyqta5okwdqcvln6ysrdsyx5elqi5zhlbe62guqhxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab 889624e49910df884c1d72ac380aab6fb1288e58bf48b823b93ac24f68d481ee

(this sample)

Loki

Executable exe 80c2d3e3f00d60ab27069ab1d911bbccadd2ba38df47c098d1efc2a0092ff320

  
Dropping
MD5 99039a9f751f9b9d627401a5688e0066
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 80c2d3e3f00d60ab27069ab1d911bbccadd2ba38df47c098d1efc2a0092ff320

Comments