MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6c8037facd843cfded76d5d403438845369f0f161ec6385d84c248e9149e40a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b6c8037facd843cfded76d5d403438845369f0f161ec6385d84c248e9149e40a
SHA3-384 hash: 2c9c80b134ce0820a6883e436150f4702d6742617e91229f3632b2d747f2aa6eacdb399588210305d9e9cee81e628343
SHA1 hash: c3d9c08fa11c4bdf093959ecf76ce7af906b1456
MD5 hash: 257e6eecfc8c1feef9e1c85ddc5674dd
humanhash: wyoming-washington-friend-arizona
File name:Payment Slip copy.img
Download: download sample
Signature Loki
Create hunting rule
File size:1'245'184 bytes
First seen:2022-06-09 13:41:28 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:gP9C8+jXbW9qT9q0LzW4S6O4CUbIjAl3TcbGU5XcqPno+qa:gPlCXKOnLK4VCel3vU51nS
TLSH T10D451210F2EA42C0F2270F780D271A4286F9565259BBDE3F79BDEA8F478E7C5053A152
TrID 99.6% (.NULL) null bytes (2048000/1)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Reporter cocaman
Tags:img Loki payment


Avatar
cocaman
Malicious email (T1566.001)
From: "TaeOan Kim Financial Manager <taeoankim@naver.com>" (likely spoofed)
Received: "from cool.tupperware.icu (tupperware.icu [144.126.209.88]) "
Date: "Thu, 09 Jun 2022 05:07:15 -0700"
Subject: "PAYMENT DETAILS COPY"
Attachment: "Payment Slip copy.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
285
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Strictor.268676.14238.24299.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62a1f88e4c4e28fcf3baed3a/reports/a3ce3b4b-f274-43e1-8c12-57f65450885b/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b6c8037facd843cfded76d5d403438845369f0f161ec6385d84c248e9149e40a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-06-09 11:29:20 UTC
File Type:
Binary (Archive)
Extracted files:
28
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w3eag75m3bb47xwxnvouanbyqrjwt4hrmhwghboyjqsi5ekj4qfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b6c8037facd843cfded76d5d403438845369f0f161ec6385d84c248e9149e40a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

img b6c8037facd843cfded76d5d403438845369f0f161ec6385d84c248e9149e40a

(this sample)

Loki

Executable exe c7dde97327bfb96762a70d54b6e9a98ab973d39520de7f7cb1f475654cb8ae8b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c7dde97327bfb96762a70d54b6e9a98ab973d39520de7f7cb1f475654cb8ae8b
  
Dropping
Loki
  
Dropping
MD5 4b4381a4e64200ea42691343eb32e09e

Comments