MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7272868949fd062d682c1181e97c2cc402387bdc2fcf30231d147b3b279c84c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c7272868949fd062d682c1181e97c2cc402387bdc2fcf30231d147b3b279c84c
SHA3-384 hash: 125e763df709a6ddf94b083e4ca91105b44215cc66e7c482d6dd61abcc3481ab78a9705332cb9a18f85951d0b76fe983
SHA1 hash: 552bc953b3822efcff9c8f1eb1aae74852ca31b3
MD5 hash: 823a161d458afb4dc3f62c4660506cbb
humanhash: bluebird-artist-music-hawaii
File name:Po_20201015.gz
Download: download sample
Signature Loki
Create hunting rule
File size:352'473 bytes
First seen:2020-10-15 12:56:35 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:gnb9FZdnZiakJv5/Kf7lOoxwh3R7IS2xooEXVl4uRD6NgEduav:Yb9z2VKTdx4t2xoTXV52GEdN
TLSH 6674237730711002D6C2BE1ABD86BD4536CA59C431FFEB4E51AF9DA379F0628E67A240
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: xbx0.506.fdion.ml
Sending IP: 68.183.49.202
From: Nguyen Quoc Thong <nqthong@506.fdion.ml>
Subject: Re: Purchase Order
Attachment: Po_20201015.gz (contains "Po_20201015.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42621.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c7272868949fd062d682c1181e97c2cc402387bdc2fcf30231d147b3b279c84c/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 09:39:28 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y4tsq2eut7igfvucyemb5f6czrachb55yl6pgarr2fd3hmtzzbga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c7272868949fd062d682c1181e97c2cc402387bdc2fcf30231d147b3b279c84c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz c7272868949fd062d682c1181e97c2cc402387bdc2fcf30231d147b3b279c84c

(this sample)

Loki

Executable exe 03bdd34865273923034d10f9c46da5d0c82f7c42ff03f5db033e06b46f817fe2

  
Dropping
MD5 104d468a05ca5138876654d59b6445a1
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 03bdd34865273923034d10f9c46da5d0c82f7c42ff03f5db033e06b46f817fe2

Comments