MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0fd1ddf542f9746a9e25ceb976d416b8385d837d5e71bb02bd9b999083620d9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0fd1ddf542f9746a9e25ceb976d416b8385d837d5e71bb02bd9b999083620d9f
SHA3-384 hash: d388a56f055f259006d25a66c61251f44dcd3c2f6c8726a0f7e7d6b75fa88c681d9a32f0c0cabf686bea74ed862a57f8
SHA1 hash: 22e4deac09d192bb3c0976b17985c074146e3f60
MD5 hash: 37809ad38825bb2fccd17bdda3c38450
humanhash: georgia-saturn-august-helium
File name:37809ad38825bb2fccd17bdda3c38450.exe
Download: download sample
Signature Loki
Create hunting rule
File size:363'315 bytes
First seen:2020-06-09 10:09:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c2c71dfce9a27650634dc8b1ca03bf0 (160 x Loki, 58 x Formbook, 55 x Adware.Generic)
ssdeep 6144:/PCganNgkvzQuwYmgt3BKK3CF5/UgapryT++ZC7TckBm67NuYtmMq+VZDC0PhmX6:Van+Ezrr3xKCCF5M1pmT++ZC8kx7NulO
Threatray 5'424 similar samples on MalwareBazaar
TLSH 1574125A77B0C9A3F5AFC1B02477A278767187161111813F2BE03E4A7823AC5DA1F69E
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://b2bseller.ga/webxpo/gate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

SecuriteInfo.com.Artemis162931E90DCF.4593.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Rescoms
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 10:11:04 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b7i535kc7f2gvhrfz24xnvawxa4f3a35lzy3wav5tomzba3cbwpq._file
Verdict:
malicious
Similar samples:
06cedd3e446db41cd53877ce7b7c24c31bc034260d7de377c01bb06e1ea9add0
Loki
0e661b488a5571afb39ddf31bda089f7c032ed0a077501c3b7c8a31a0a6442d6
Loki
52ea3c1f51eb3a8920e2895ebe7d54ed9b010407775434da9c47fdeceae7af84
Loki
8a1f8815b2d54f7171358001bec7be97d87660a29d8bce9d247da901b012f594
Loki
8df5858f489a1dd9f113eda4dbe0aded3fd5a128dd32e991e94c5a2b7623ba64
Loki
99ae2d3c813970e279188fa1fce92e70ac2ba63c03d2d04fd6f719d4953169c3
Loki
d4405060b30fab298c2747fc58ec301dfa160be2df3e335a78900fac044a2493
Loki
d789a675b16eca7a3d78fffd03d6dfc18a396d6eac4da2472b99700ff1cb09c7
Loki
db4aad17cb58975d3c42dc37b92e7c8bfdce82da52c5eb6a5e87709cf906a684
Loki
f69e7749b6798b4c4f258eebbedc77992536cc24bef9d1bf3d68315ad16abcf0
Loki
+ 5'414 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/201109-xsy22yw29n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Loads dropped DLL
Lokibot
Malware Config
C2 Extraction:
http://b2bseller.ga/webxpo/gate.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Lokibot
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

Executable exe 0fd1ddf542f9746a9e25ceb976d416b8385d837d5e71bb02bd9b999083620d9f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/384314/
  
Delivery method
Distributed via web download

Comments