MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f975897ec657cbc0ac4a3fd92496162c111f7edc48898a8cf73bbb040d822da9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f975897ec657cbc0ac4a3fd92496162c111f7edc48898a8cf73bbb040d822da9
SHA3-384 hash: f020248bf3c552f752193bb70a12b77be305b948db68148d940c4652a92c8cb4996343978acc4dc8e77288f095ea604e
SHA1 hash: 5bf6a5461f6de549227834e1170b215b831e52aa
MD5 hash: 40dab9c4479d066dfde839dad8302ae3
humanhash: triple-mexico-johnny-leopard
File name:QUOTATION22110577.gz
Download: download sample
Signature Loki
Create hunting rule
File size:316'638 bytes
First seen:2020-11-26 06:37:47 UTC
Last seen:2020-11-26 07:14:21 UTC
File type: gz
MIME type:application/x-rar
ssdeep 6144:nreObF6bzRLLI7gJNlBiU5sPW9vcsYOm8A+lKVQE6c4RmO62Kevb:nJeRfIa7BiU5jDNAlQ9c4AOFdb
TLSH B4642389FAE2707AC3E0D9B5B4C644206E13FB78D76631FABCA47759D3849230419D2D
Reporter abuse_ch
Tags:gz Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: cyber.net.pk
Sending IP: 45.147.230.114
From: Mrs. Latifa METHNENI <tdp@cyber.net.pk>
Subject: REQUEST FOR QUOTATION
Attachment: QUOTATION22110577.gz (contains "QUOTATION22110577.exe")

Loki C2:
http://greenitylogistics.com/scss/bootstrap/mixinss/five/fre.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f975897ec657cbc0ac4a3fd92496162c111f7edc48898a8cf73bbb040d822da9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-26 06:38:05 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7f2ys7wgk7f4blckh7msjfqwfqir67w4jceyvdhxho5qidmcfwuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz f975897ec657cbc0ac4a3fd92496162c111f7edc48898a8cf73bbb040d822da9

(this sample)

Loki

Executable exe d346086418bbd48dabcfb8ea48bad551ec66d79c3c0a2e198cd3a1083a80057f

  
Dropping
MD5 025c9e5be7bf95f51225106ef7e7f7b9
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d346086418bbd48dabcfb8ea48bad551ec66d79c3c0a2e198cd3a1083a80057f

Comments