MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3f453eb628be4f656db29ff51f04a106a2dcd5accae4c4efd18a11133147d16. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3f453eb628be4f656db29ff51f04a106a2dcd5accae4c4efd18a11133147d16
SHA3-384 hash: 7baa4f8642e504ee98093d98dade4a11eee5d3e63a026d9fa57bbda78bdcd178c409fbfd86b4f75124831fb572685f36
SHA1 hash: ede589eaaf20495c903c2cd1ca43b355e3a2e451
MD5 hash: 28592d25b7512e1303887d0c424cf4db
humanhash: berlin-nuts-pizza-bluebird
File name:WNIOSEK O OFERTĘ 03-03-2021-pdf.zip
Download: download sample
Signature Loki
Create hunting rule
File size:301'151 bytes
First seen:2021-03-03 07:28:52 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:OkMUjF1n1T8olUpCOMpTImGsQCgmigycdfK5h9x1lMbHSBXgQLG:LMUj7n1THlUodBIfmigyc5MXx1lrwQC
TLSH 1D54234F4626419B780081A7D47FDCC658B3AB5A195F002671ACDF8748B29FB939DFE0
Reporter abuse_ch
Tags:geo POL zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: s449.sureserver.com
Sending IP: 192.252.154.28
From: Uniwersytet Warszawski <admin@adm.uw.edu.pl>
Subject: WNIOSEK O OFERTĘ (Uniwersytet Warszawski) EUI894/BU463
Attachment: WNIOSEK O OFERTĘ 03-03-2021-pdf.zip (contains "WNIOSEK O OFERTĘ 03-03-2021-pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_badexts47.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25906.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a3f453eb628be4f656db29ff51f04a106a2dcd5accae4c4efd18a11133147d16/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 07:29:06 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=up2fh23crpspmvw3fh7vd4ckcbvc3tk2zsxeytx5dcqrcmyupula._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/a3f453eb628be4f656db29ff51f04a106a2dcd5accae4c4efd18a11133147d16

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip a3f453eb628be4f656db29ff51f04a106a2dcd5accae4c4efd18a11133147d16

(this sample)

Loki

Executable exe 2c151e8a462558e66b1cfd1a84fc7348d145bc4d5e0456bacc423743a30a7390

  
Dropping
MD5 2e1ab7210277a4f270588d13dc74cfa6
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2c151e8a462558e66b1cfd1a84fc7348d145bc4d5e0456bacc423743a30a7390

Comments