MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa3d1d5692e53012cb27dbf944db6f3ca633fa20c44cf5b3195383df83d00b41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa3d1d5692e53012cb27dbf944db6f3ca633fa20c44cf5b3195383df83d00b41
SHA3-384 hash: 7eac0c395d46b8791aadd1616eb30cf774c7766281b9d09c541cdadde62dcab96f67edb379e2572d69a2ac484ec2a3ad
SHA1 hash: 6409c8ded30b725eda0d0d84fb73cad99c3954e4
MD5 hash: d55947399bb5efb4a7fce53f9b20745f
humanhash: tango-alanine-maine-avocado
File name:order (076_20_186).zip
Download: download sample
Signature Loki
Create hunting rule
File size:752'254 bytes
First seen:2020-12-18 12:10:37 UTC
Last seen:2020-12-24 08:49:33 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:ocJyNycOC+/vcqr4IPT2+yM1Au0fIJgX+k6IsTClVj+6ZfD09:RoZOCevcI4w0MigGD6IKCj+b9
TLSH CDF42323429F64375DDA4B06BBC6BA226BA34874DDEF1D5134E8BA388FDBF11914018D
Reporter cocaman
Tags:Loki zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Raza Ansari<sales@rockmechenterprises.com>" (likely spoofed)
Received: "from rockmechenterprises.com (host.mm-online.ga [185.222.57.247]) "
Date: "18 Dec 2020 02:45:15 -0800"
Subject: "RE:RQ NEW ORDER.........REF_(076-20/186)"
Attachment: "order (076_20_186).zip"

Intelligence

File Origin
# of uploads :
8
# of downloads :
169
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs2008.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25529.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25650.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fa3d1d5692e53012cb27dbf944db6f3ca633fa20c44cf5b3195383df83d00b41/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-17 23:53:41 UTC
File Type:
Binary (Archive)
Extracted files:
31
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7i6r2vus4uybfszh3p4ujw3phstdh6rayrgplmyzkob57a6qbnaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fa3d1d5692e53012cb27dbf944db6f3ca633fa20c44cf5b3195383df83d00b41

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip fa3d1d5692e53012cb27dbf944db6f3ca633fa20c44cf5b3195383df83d00b41

(this sample)

Loki

Executable exe 59ec86c8b18a331a2679a555114120a087f3eddfb828dd815fd09748ed9e8403

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 59ec86c8b18a331a2679a555114120a087f3eddfb828dd815fd09748ed9e8403
  
Dropping
Loki

Comments