MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6cc687def452a2b73f80ced0a6e751ec60b9f565b66d380b5bf292de017c8e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e6cc687def452a2b73f80ced0a6e751ec60b9f565b66d380b5bf292de017c8e8
SHA3-384 hash: 284af6fa942be8b9e425acb19abfce4a55e0fcee0f9dd3a9d8ef8e70a2c291501cb4586fb02a1bc36dc7c876f9f21c83
SHA1 hash: 5bfb615e9d55703dd0de63fa6f49e63eb5ef6e42
MD5 hash: d36d8632cb934d9bf4f2024b2b4c46ff
humanhash: mountain-ink-jig-tango
File name:ORIGINAL SCANNED COPY.xlsx.blu.zip
Download: download sample
Signature Loki
Create hunting rule
File size:513'351 bytes
First seen:2020-12-13 15:57:53 UTC
Last seen:2020-12-13 20:12:24 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:iE1l8zbCmIi90USQxjzLF7qZoYsw1HjQ4SeBvBmEa:iEYzblIi9SQ9l7MTsERxir
TLSH A5B42365F467805FE3B2287AD56D40F8E4A16A44AD38119851B3DBB23E8C3E6E4C1CFD
Reporter cocaman
Tags:Loki zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Melike OZER <cintro@lenoxia.com>" (likely spoofed)
Received: "from lenoxia.com (unknown [103.53.41.195]) "
Date: "14 Dec 2020 01:14:35 +0530"
Subject: "ORDER AST0057734"
Attachment: "ORIGINAL SCANNED COPY.xlsx.blu.zip"

Intelligence

File Origin
# of uploads :
4
# of downloads :
172
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.generic.ml.22579.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e6cc687def452a2b73f80ced0a6e751ec60b9f565b66d380b5bf292de017c8e8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-13 14:06:25 UTC
File Type:
Binary (Archive)
Extracted files:
29
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=43ggq7ppiuvcw47ybtwqu3tvd3daxh2wlntnhafvx4us3yaxzdua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e6cc687def452a2b73f80ced0a6e751ec60b9f565b66d380b5bf292de017c8e8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip e6cc687def452a2b73f80ced0a6e751ec60b9f565b66d380b5bf292de017c8e8

(this sample)

Loki

Executable exe 8733acdd1d6cefd0a4cdcdf04249ad06690fe0335055f3e8f6fd914ec23434ae

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8733acdd1d6cefd0a4cdcdf04249ad06690fe0335055f3e8f6fd914ec23434ae
  
Dropping
Loki

Comments