MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92bda4abf911a6bed2e1fe09d297c1f9df83d1cc64786adced8951fd1df9b7da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92bda4abf911a6bed2e1fe09d297c1f9df83d1cc64786adced8951fd1df9b7da
SHA3-384 hash: 1df7f985d45e675f1c7546f251c8afdb72872037cdcc003b43ceff56b38f62a9b1b410a9c86622a6dee3d8c92ff8a775
SHA1 hash: 002159eb6ea3ebceffecbd96a7833482020e68f8
MD5 hash: 421c67e4038348be3ffb69a3f44cf08d
humanhash: spaghetti-river-venus-failed
File name:REMITTANCE_SLIP_pdf.rar
Download: download sample
Signature Loki
Create hunting rule
File size:322'699 bytes
First seen:2020-10-28 07:44:16 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:FtTicNp4t2wdRt3ETqa1CVao/NYrAaszsr2OvyhR4JuZy7phJzOE:jiVYw3tUYnGBvGmhJzOE
TLSH 1C6423EA4219008DC2F1D6A20A30C55CA8FB54534B552E31FBDB76210CADF4EAED8B77
Reporter abuse_ch
Tags:Loki rar


Avatar
abuse_ch
Malspam distributing Loki:

HELO: india.dsmindia.com
Sending IP: 103.8.127.155
From: Clio Shipping and Logistics Viet Nam - Inc <clio@clioshipping.com.vn>
Subject: Remittance Advice _SWIFT COPY
Attachment: REMITTANCE_SLIP_pdf.rar (contains "REMITTANCE_SLIP_pdf.exe")

Loki C2:
http://tosisenintl.ml/officem8/logs/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/92bda4abf911a6bed2e1fe09d297c1f9df83d1cc64786adced8951fd1df9b7da/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-28 05:21:38 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sk62jk7zcgtl5uxb7ye5ff6b7hpyhuommr4gvxhnrfi72hpzw7na._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/92bda4abf911a6bed2e1fe09d297c1f9df83d1cc64786adced8951fd1df9b7da

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 92bda4abf911a6bed2e1fe09d297c1f9df83d1cc64786adced8951fd1df9b7da

(this sample)

Loki

Executable exe 7e9e50f6549f5f87f0bab14f30fd50854351cca2003c815903cc8bb6b96c94b5

  
Dropping
MD5 2f5da4665fdb5886ccf65df557257b68
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7e9e50f6549f5f87f0bab14f30fd50854351cca2003c815903cc8bb6b96c94b5

Comments