MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2f66f6028b7d3a701cbb4f49de1df2182e1ac26a9b500d5e7a6ba7b773574e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2f66f6028b7d3a701cbb4f49de1df2182e1ac26a9b500d5e7a6ba7b773574e6
SHA3-384 hash: d849158524af3a6879a5c93f7cf8f86f621c5655408fdc295c40dd6d578788d097badee0b00a129600ba47e7771e64b3
SHA1 hash: 7152824263474d47296e10448782c5e173fefc8f
MD5 hash: 42944594919b52fcc4f0a94c57d6cc0d
humanhash: timing-arizona-cardinal-friend
File name:Jinsung Precision.pdf.cab
Download: download sample
Signature Loki
Create hunting rule
File size:193'531 bytes
First seen:2020-07-22 09:23:21 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 3072:MIRFYiXLvoF4DqRrp0iGvqzQeRELO5NwYEWLzQcT8z2jv7ZrcYMxBoiR:MIXYiXLvoF4Gb0HCzlEANmGvvtrcfxBZ
TLSH 421412211D4AC37CD83844AA6AFA1673CF53FF88DE4BE65413469EE7109DC784ACA0D9
Reporter abuse_ch
Tags:cab Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail-smail-vm39.hanmail.net
Sending IP: 203.133.180.227
From: Jinsung Precision <siwon22@hanmail.net>
Subject: 견적요청서 송부의건
Attachment: Jinsung Precision.pdf.cab (contains "PO.exe")

Loki C2:
http://79.124.8.8/plesk-site-preview/akinsab.ru/http/79.124.8.8/goodluck/Panel/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2f66f6028b7d3a701cbb4f49de1df2182e1ac26a9b500d5e7a6ba7b773574e6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 09:25:06 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6l3g6ybiw7j2oaolwt2j3yo7egbodlbgvg2qbvphu25hw5zvotta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab f2f66f6028b7d3a701cbb4f49de1df2182e1ac26a9b500d5e7a6ba7b773574e6

(this sample)

Loki

Executable exe 665988677df79f27d400cacff835a5de0332972f1dae42d1e656a3afc20009a7

  
Dropping
MD5 3e299320b9b0c77678887859483a4525
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 665988677df79f27d400cacff835a5de0332972f1dae42d1e656a3afc20009a7

Comments