MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc591e2a3cc3074414ec853fdd991cb4b242c7f1df148edf275412ac82cf3fef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc591e2a3cc3074414ec853fdd991cb4b242c7f1df148edf275412ac82cf3fef
SHA3-384 hash: fbd80d33f6eb06b4e3a138c1cbe8b15a04a08d3a9a74beaf2a36e2a48b21ee24a2aecf85230250cb417d037b19bcfc12
SHA1 hash: d6d8d337d5e36c095af115b0441756874e3d6790
MD5 hash: f7c04f1c766465c9bf733d19143acf78
humanhash: butter-pennsylvania-helium-friend
File name:PO_00151896.rar
Download: download sample
Signature Loki
Create hunting rule
File size:382'853 bytes
First seen:2021-04-06 08:21:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:ajs+c0RdrOq1h5b65MtpI4BOhNptBqKujZXzTwnehKhCGyudAif3y1:ek0TCqh5bGYdBUR3SZfPhKRyuuwy1
TLSH B48423087E3451AF4D8F96B7AA836598B1F2546971FF18C898EF5322133C760E81D27A
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail0.fycompanies.com
Sending IP: 165.232.171.148
From: Malar Reddy <sales@fycompanies.com>
Subject: Standard Purchase Order
Attachment: PO_00151896.rar (contains "PO_00151896.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc591e2a3cc3074414ec853fdd991cb4b242c7f1df148edf275412ac82cf3fef/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-04-06 03:05:00 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zrmr4kr4ymduifhmqu753gi4wszefr7r34ki5xzhkqjkzawph7xq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cc591e2a3cc3074414ec853fdd991cb4b242c7f1df148edf275412ac82cf3fef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar cc591e2a3cc3074414ec853fdd991cb4b242c7f1df148edf275412ac82cf3fef

(this sample)

Loki

Executable exe 75692933366e01cb320075f6bcadce5fd2192a680c5671323851006561fd6fc4

  
Dropping
MD5 19f1b8d8a07f83dbb8fc3b3520f1eaf9
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 75692933366e01cb320075f6bcadce5fd2192a680c5671323851006561fd6fc4

Comments