MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2eb9d3b267017e12783ba00f49738544a6e074c1454af4c3291766e64e08c85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2eb9d3b267017e12783ba00f49738544a6e074c1454af4c3291766e64e08c85
SHA3-384 hash: 040a400406de6f631d490ed9109ac70810715faec49bd701d993c141b943a953d507f00127689b24086b7f0e85c07311
SHA1 hash: b760673ee089833c3bac85b23bad24f94c1445d5
MD5 hash: e9e5e77f80d6aa8598b1c325a49aef3e
humanhash: dakota-bakerloo-social-early
File name:Doc00638832664.img
Download: download sample
Signature Loki
Create hunting rule
File size:1'572'864 bytes
First seen:2021-01-14 20:11:15 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:Mp/yzTTy4h4vGMTnURC/7dMmBlIzEGEL50FdUzKH0Se9gS3jZbXng7RWX1/sCYdp:+y3GgWPT4gGEL5MdTH+
TLSH 067507997B5073DEC95FD8BA9A541C64BA90A17AA35FD303D01310A89F4D85BCFAC0F2
Reporter abuse_ch
Tags:DHL ESP geo img Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: smarthost1.gohsphere.com
Sending IP: 173.0.129.225
From: Gerente de carga de DHL <facturacion.mx@dhl.com>
Subject: nueva notificación de envío de DHL
Attachment: Doc00638832664.img (contains "Doc00638832664.PDF____________________.bat")

Loki C2:
http://51.195.53.221/p.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
147
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis142D300F5549.26272.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c2eb9d3b267017e12783ba00f49738544a6e074c1454af4c3291766e64e08c85/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-01-14 15:18:27 UTC
AV detection:
8 of 45 (17.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ylvz2ozgoal6cj4dxiapjfzykrfg4b2mcrkk6tbssf3g4zharscq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c2eb9d3b267017e12783ba00f49738544a6e074c1454af4c3291766e64e08c85

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

img c2eb9d3b267017e12783ba00f49738544a6e074c1454af4c3291766e64e08c85

(this sample)

Loki

Executable exe 50bf04730d6eff098559c9ed03d0eab638bcb9bd954dc5b41ed37413bf47b3a1

  
Dropping
MD5 142d300f5549ce63cef48ed7e6feb56c
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 50bf04730d6eff098559c9ed03d0eab638bcb9bd954dc5b41ed37413bf47b3a1

Comments