MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 207047a5a1c53096d90e419108d8da157d64591bc4268896eda22d8b9096159f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 207047a5a1c53096d90e419108d8da157d64591bc4268896eda22d8b9096159f
SHA3-384 hash: e9659a908fdb2f1f51a6ca9229622150bd5062e8463858bfc3f35585eb0692a5d03562d425af6d29bcf192e9a11b6782
SHA1 hash: fa4755cd3436a869172e32c6c480e378f9de5ce5
MD5 hash: 98a1e9887569dd4f9940ad900e11f952
humanhash: kentucky-blue-oregon-ink
File name:win32(2).exe
Download: download sample
Signature Loki
Create hunting rule
File size:1'568'768 bytes
First seen:2020-04-20 06:29:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:7AHnh+eWsN3skA4RV1Hom2KXSmdalsLf2fbRJ3MgjKIzUFYgWh4A9SFK5vkN5:Wh+ZkldoPKi2alc2f1B6eBgpA9UK5vS
Threatray 2'195 similar samples on MalwareBazaar
TLSH C475DF0273D2C036FFAB92739B6AF64156BC79654123852F13981DB9BD701B2263E363
Reporter oppimaniac
Tags:Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Gorgon
Create hunting rule
Status:
Malicious
First seen:
2020-04-20 06:35:32 UTC
File Type:
PE (Exe)
Extracted files:
26
AV detection:
27 of 31 (87.10%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
00372c59a05ba9cce6ab5a40b28e8bd7db5a284e019dbaaaccf30408ec14f26f
Loki
549041de891707defd3ad382b4a084683e0079d161edc02cc4ad16319402d7df
Loki
5b1d3586730acfe3811da5a99d67c64875f8177e4bda83dd1d3e298c0eddc272
Loki
67917e8a295ace02f84c39d08c1691c651fc143901c4525f3178af87a837e1a6
Loki
7d39eb29d6c1e5680f976e6d09445a59230379aac876427e9f2039548acb400f
Loki
7e784491a41c322df63b093c3966bc9c0d209e66706c890a4803b39de0dec51d
Loki
80cc30eb8760621854de71b1265b18be5902efd7577ae69b442264598041e3c9
Loki
cf0d07700b71c7041c0e761c114b1555e5cf66c61f4e0812a96b83e087c3cd35
Loki
df45539070549fcd1b975375d43dc929ba5f50ff89050ae80c9ea64e28cb90ae
Loki
f0224af96362f4a0ce3124c641d2be5f99773d37fb1c47339f9e2561420e0363
Loki
+ 2'185 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

Executable exe 207047a5a1c53096d90e419108d8da157d64591bc4268896eda22d8b9096159f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/346631/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::CopySid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::GetLengthSid
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::GetAce
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CoCreateInstanceEx
ole32.dll::CoInitializeSecurity
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mciSendStringW
WINMM.dll::timeGetTime
WINMM.dll::waveOutSetVolume
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAce
ADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetAclInformation
ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserW
KERNEL32.dll::CreateProcessW
ADVAPI32.dll::CreateProcessWithLogonW
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::SetSystemPowerState
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileExW
KERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
IPHLPAPI.DLL::IcmpCreateFile
KERNEL32.dll::CreateFileW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LogonUserW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetAddConnection2W
MPR.dll::WNetUseConnectionW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegConnectRegistryW
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::BlockInput
USER32.dll::CloseDesktop
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::FindWindowW

Comments