MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e32b809460c44eedb0308e3f1399b04ee29f88d97f9058e0ea0b98949ce58dbd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e32b809460c44eedb0308e3f1399b04ee29f88d97f9058e0ea0b98949ce58dbd
SHA3-384 hash: 4d3bf850dbdc438c84e61653e13f164a7862b90493e2dff7d15eadc2a3867f8e19420983c208594a4333d79f5e94f240
SHA1 hash: e4d7495f8e62828251eda27cad68541172bb58de
MD5 hash: dc2ff21f486d21787ffd4298774afc9f
humanhash: tennessee-finch-lithium-one
File name:Purchase Order_84755643_gpj.zip
Download: download sample
Signature Loki
Create hunting rule
File size:268'513 bytes
First seen:2021-01-07 14:08:30 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:uW+eqHuKrdQojXCSYYbLZKVjgNRrtqAQyHvNncB:zqHDJQojyF4YVjgNymHvNncB
TLSH F34423E7AED2D1FD7A2875A1C1DF7871BAA913D5941047C508E7D864B03A8F4ED0CC1A
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: cpanel7.grena.ge
Sending IP: 217.147.225.209
From: Priscilla Deijs <jeffie.lee@assudamal.com >
Subject: RE:New order (PO-20203943)
Attachment: Purchase Order_84755643_gpj.zip (contains "IMG_84755643‮gpj.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
217
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs1702.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25676.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22989.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.17622.ziprtlo.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e32b809460c44eedb0308e3f1399b04ee29f88d97f9058e0ea0b98949ce58dbd/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-01-07 14:09:14 UTC
AV detection:
7 of 46 (15.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4mvybfdayrho3mbqry7rhgnqj3rj7cgzp6ifryhkbomjjhhfrw6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e32b809460c44eedb0308e3f1399b04ee29f88d97f9058e0ea0b98949ce58dbd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip e32b809460c44eedb0308e3f1399b04ee29f88d97f9058e0ea0b98949ce58dbd

(this sample)

Loki

Executable exe ea2c05a7e476d1410b1be9db71b2a7fc963b1418b75ab00b8ede81bb65ec7366

  
Dropping
MD5 3551359877a8484bbf336467745e8b3b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ea2c05a7e476d1410b1be9db71b2a7fc963b1418b75ab00b8ede81bb65ec7366

Comments