MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f81bd964ce4893315ef208f611f266e07b5d35e5aae57d94796b210a4b47dea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f81bd964ce4893315ef208f611f266e07b5d35e5aae57d94796b210a4b47dea
SHA3-384 hash: 9dc7ce7e3466a1d847b7cfd1da00b4d865ba9169cdd7af1b091a4709d86a53f4632a3f23be169c07f964511e28aee153
SHA1 hash: 994235cadfb1a662560ae3688496a3ddcc76b303
MD5 hash: caa68a0b4d204f3291dd6b46d50101dc
humanhash: earth-india-finch-white
File name:Shipping _doc_pdf scan 0094775885895.iso
Download: download sample
Signature Loki
Create hunting rule
File size:1'402'880 bytes
First seen:2021-03-09 15:48:30 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:lR2iivZQbqLA+2D1cpkmoDK2rIjPv8oQf3ns8Tu5V+IP9i+8gNAUVcmWqeUayGzK:lRivZQbqLA+2D1cpkmoDK2rIjPv8oQfC
TLSH 92558C09BB84AFE5C1160F358927A81843F881675336FB5F3DD0A9E55E2074A4E2F4AF
Reporter abuse_ch
Tags:iso Loki


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: pop.kenyaweb.com
Sending IP: 194.201.253.11
From: info@primecom.co.ke
Reply-To: shiping@penavicoyk.com
Subject: Arrival Notice (Shipping _doc_pdf scan 0094775885895)
Attachment: Shipping _doc_pdf scan 0094775885895.iso (contains "Shipping _doc_pdf scan 0094775885895.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Barys.24018.30901.26747.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 09:24:53 UTC
AV detection:
6 of 47 (12.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r6a33fsm4setgfppechwchzgnyd3lu26lkxfpwkhs2zbbjfupxva._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/8f81bd964ce4893315ef208f611f266e07b5d35e5aae57d94796b210a4b47dea

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

iso 8f81bd964ce4893315ef208f611f266e07b5d35e5aae57d94796b210a4b47dea

(this sample)

Loki

Executable exe 8f2fb0c54f7b6c6ccc3bc70cfa83165a4b8905b89744dd98a01ad7f632c82f95

  
Dropping
MD5 2ac976b117da7c02d8f85e4efc17483d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8f2fb0c54f7b6c6ccc3bc70cfa83165a4b8905b89744dd98a01ad7f632c82f95

Comments