MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10e06d6dedcfa52bb09cfb066ed4b5276a6a60ccfc5a6230911ce04b829f381f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 4

Intelligence 4 IOCs YARA 3 File information Comments

SHA256 hash:	10e06d6dedcfa52bb09cfb066ed4b5276a6a60ccfc5a6230911ce04b829f381f
SHA3-384 hash:	d104387f2d3f6ed3c2f969b60ce46a1611a6324677cac19949c7acccecd5e01ba64c91cf42b23dcee937941b65d1ee6d
SHA1 hash:	f29a348f16b6d75a9d89101ff37c3452407b461a
MD5 hash:	43bec9ddd21545d7123207e39d879766
humanhash:	helium-wolfram-hamper-burger
File name:	DHL 821673378900____pdf____.bat
Download:	download sample
Signature	Loki Create hunting rule
File size:	90'112 bytes
First seen:	2020-05-07 09:56:44 UTC
Last seen:	2020-05-07 10:44:55 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	ef0ae1bb4c39db77295c76b1d90044fb (1 x Loki)
ssdeep	768:FEUsNORF+tfUpk8dp+gTyYEkg9Hz80jGHX4t4ei0n68WhtfwrckSv9y3+:FD+mAtfUpdp+gTyGGGHX4tCCJCj9yu
Threatray	928 similar samples on MalwareBazaar
TLSH	7893D4527EF0EE36E26075B0EB65F79EC352AC3016324D1765853A2A5F36E229D3021F
Reporter	cocaman
Tags:	bat Loki

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Variant.Razy.667447.24129.11325.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Androm

Status:

Malicious

First seen:

2020-05-07 10:53:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 31 (70.97%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cdqg23pnz6ssxme47mdg5vfve5vguygm7rngemerdtqexau7hapq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

persistence

Link:

https://tria.ge/reports/201109-vxjvsrtzzx/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Adds Run key to start application

Checks QEMU agent state file

Loads dropped DLL

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Lokibot Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com