MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd21478632fea77859e9dd5ba4e0d33b0ded4299b239c5944186fc9e4ab81305. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd21478632fea77859e9dd5ba4e0d33b0ded4299b239c5944186fc9e4ab81305
SHA3-384 hash: 7ba2f6336e92c43005df5d7ab6e8a7a46b2c6db1d8f759c7d26ece7fdec02e96029350f65e618822c84319cb97c69b0b
SHA1 hash: c2275d173f90d0fadb08ab61b06d67a3fd64a691
MD5 hash: aa02aa15ee35aabeef98d9087afde67c
humanhash: foxtrot-nevada-triple-failed
File name:gunzipped
Download: download sample
Signature Loki
Create hunting rule
File size:880'640 bytes
First seen:2021-01-15 07:14:47 UTC
Last seen:Never
File type: tar
MIME type:application/x-tar
ssdeep 12288:lH1yaElE9Yt9gusNqdkYUo4pKHJ7uQjw:lVyllzt9g5c/IKp7y
TLSH 70159E7C277BBE8CD1791AB60DE1592707623D0624F8C61E0CD97ECA0575B402EA9EB3
Reporter abuse_ch
Tags:Loki TNT


Avatar
abuse_ch
Malspam distributing Loki:

From: Vindhya Shipping Co.Ltd. <acct1@vindhyashipping.com>
Subject: RE: Re: Payment Notification_INV.5199/ 14.01.2021
Attachment: gunzipped (contains "TNT Original Invoice.exe")

Loki C2:
http://51.195.53.221/p.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
150
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen11.57608.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bd21478632fea77859e9dd5ba4e0d33b0ded4299b239c5944186fc9e4ab81305/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-01-15 04:47:56 UTC
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xuqupbrs72txqwpj3vn2jygthmg62quzwi44lfcbq36j4svycmcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bd21478632fea77859e9dd5ba4e0d33b0ded4299b239c5944186fc9e4ab81305

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

tar bd21478632fea77859e9dd5ba4e0d33b0ded4299b239c5944186fc9e4ab81305

(this sample)

Loki

Executable exe f58cdcc753abc5e59a1d6367b421517b89992a43b41b9bccdb277ef69de4d6b0

  
Dropping
MD5 5c7188426a084631737fc8792926945e
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f58cdcc753abc5e59a1d6367b421517b89992a43b41b9bccdb277ef69de4d6b0

Comments