MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cbc12788a25c2aea2ee74fad59fa78fefe9665ee8ead646a8812194f7c74ca05. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cbc12788a25c2aea2ee74fad59fa78fefe9665ee8ead646a8812194f7c74ca05
SHA3-384 hash: eac61da9610563a097e4de652cbbd00a6f9692c8d02072d77b857596e8be441fc484ce0d380339ed377f7914c6b73b4d
SHA1 hash: 6f1b20b05a569791969e8d04c69277d3231f3102
MD5 hash: e225ac5a01db8630552a4eb31988a295
humanhash: nine-autumn-solar-asparagus
File name:Tug boat.zip
Download: download sample
Signature Loki
Create hunting rule
File size:402'872 bytes
First seen:2020-10-26 13:40:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:pNkfrHZxOSj/7lqNMJZc19spBhADntKQG:EfzZtaOZC/jsQG
TLSH 91842370781A44620D343C4BDCE9A7175F596899890D99BFF7FD324ED81A4DF808790B
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: zimbra58.go4hosting.in
Sending IP: 111.118.184.249
From: Shridhar Viswanathan <donald@wescomail.us>
Reply-To: Shridhar Viswanathan <info@dayamarineconsultancy.com>
Subject: New Building Off Shore Tug
Attachment: Tug boat.zip (contains "Tug boat.exe")

Loki C2:
http://jumiliaintl.ml/officem2/logs/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cbc12788a25c2aea2ee74fad59fa78fefe9665ee8ead646a8812194f7c74ca05/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 02:08:29 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zpaspcfclqvoulxhj6wvt6ty737jmzpor2wwi2uicimu67duzicq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip cbc12788a25c2aea2ee74fad59fa78fefe9665ee8ead646a8812194f7c74ca05

(this sample)

Loki

Executable exe 66218c59b90a7b21032d19dc4c622476971a55c9d7bcf90a3d76b10319e121e4

  
Dropping
MD5 11a57219db06db4f13b81b1a6d9af1e2
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 66218c59b90a7b21032d19dc4c622476971a55c9d7bcf90a3d76b10319e121e4

Comments