MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92c1e6e58269adbede065477d21e8b9bfd4d8740ef946c29a6f6d02980e8cc7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92c1e6e58269adbede065477d21e8b9bfd4d8740ef946c29a6f6d02980e8cc7e
SHA3-384 hash: 759064545ff594497d6ba1681aadd46f0e5897bbc7606ab64d503b6104be356bd54452e0636b96f759abd877c609abc1
SHA1 hash: 1d718a780fa34581dfc9a2237c8007fd2129436a
MD5 hash: 5034e4e3bc1b00a5f0c8d4e9a6e2fb69
humanhash: oscar-coffee-floor-kitten
File name:REVISED CONTRACT 1.cab
Download: download sample
Signature Loki
Create hunting rule
File size:498'795 bytes
First seen:2020-10-23 07:00:46 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:9PL4ADnLCdrBGe0lJetLKEUu8naq9RLHnV:9FidrBrucIHnV
TLSH 26B42342FBA603C0C4F317685907DAEAD5AE8BA522C9F58FD18C55D4CACA1E4331DD9C
Reporter abuse_ch
Tags:cab Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: wxw0.223.zozio.ml
Sending IP: 159.65.118.249
From: hlliam <hlliam@bricomp.net>
Reply-To: account@bricomp.net
Subject: URGENT: Shared File Email Services
Attachment: REVISED CONTRACT 1.cab (contains "REVISED CONTRACT (1).exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis34E351ABA35C.565.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/92c1e6e58269adbede065477d21e8b9bfd4d8740ef946c29a6f6d02980e8cc7e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-23 06:46:54 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sla6nzmcngw35xqgkr35ehultp6u3b2a56kgykng63ictahizr7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab 92c1e6e58269adbede065477d21e8b9bfd4d8740ef946c29a6f6d02980e8cc7e

(this sample)

Loki

Executable exe 9254d3364f3dc1faec6f4f624e1c74f14ddfad19300eca7eb18a4a1a15cf4d98

  
Dropping
MD5 34e351aba35cdac5374310ff5254ff2d
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9254d3364f3dc1faec6f4f624e1c74f14ddfad19300eca7eb18a4a1a15cf4d98

Comments