MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39a364c35e7d9f4cacf9744207f38c903c38567a96033808a0c5559c61753379. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 39a364c35e7d9f4cacf9744207f38c903c38567a96033808a0c5559c61753379
SHA3-384 hash: 069239a3b4cfe8c3fae0fdf7b19a75c0757df9bf6af340f9c4b390297c71c58f5bd36eb1118899b9383264288e883962
SHA1 hash: 3c40eba3dd6496e843d98b0c285524c202662a39
MD5 hash: c5470aee31ac0b20c25568d870e83254
humanhash: sodium-minnesota-mississippi-west
File name:c5470aee31ac0b20c25568d870e83254.exe
Download: download sample
Signature Loki
Create hunting rule
File size:729'088 bytes
First seen:2020-06-01 09:39:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f56a7178ddd31e8b70e2c06f5413b70b (7 x AgentTesla, 3 x MassLogger, 1 x RemcosRAT)
ssdeep 12288:qUw3gNxYvSPaYgPRKNmFZ0EF2N+G1sPrLsC:qdQ0vSkIwc+G1fC
Threatray 1'490 similar samples on MalwareBazaar
TLSH C0F48DD1B290873BC053117DFC5BC6F85935FE50292999A727E3EC0EBE2A3813966193
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://mecharnise.ir/da13/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 10:35:32 UTC
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hgrwjq26pwpuzlhzorbap44msa6dqvt2sybtqcfayvkzyylvgn4q._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
093261263ec2d1ec3042f09400aa7aa6e2963fca22089bec1718bddd80225673
Loki
38605c9b483d95d6729af644ff2338d10d2b6714012c4299a083988e5739387b
Loki
3968f76530e5c9471adb0a30c06159c939f59538a27fb9e9c508857de42fc1b5
Loki
4311521a696874a86ea0e4dcecbbd6936ef077955bb85659ea1552515b6e6da0
Loki
771e24bf597185ef9c18a2b45b018773c4128f4a80fab40b5cd6d00bcce16f99
Loki
8365241d902a7196708f6ba21b1438661ac1ea2618b8046bfe8a742e1403106b
Loki
9332d033a54d5c11bb1115012e5cd8e1a08efdf242784ccad6cbeded2f57e1d0
Loki
9ed49839f97c5bd2844562286ae50e5ccf1dcf6d0b47399d857f4fd8671c01db
Loki
aad0832eac82cd800d4a149f97a0d995287968535bbf572ae3292652b748b902
Loki
e1303b3fa517337cb6c5724fb6c2dfb66cbe7a9ab93b0b7286a0972c51278bc5
Loki
+ 1'480 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/201109-zysmw3dvxe/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Lokibot
Malware Config
C2 Extraction:
http://mecharnise.ir/da13/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Lokibot
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_lokipws_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

Executable exe 39a364c35e7d9f4cacf9744207f38c903c38567a96033808a0c5559c61753379

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/365695/
  
Delivery method
Distributed via web download

Comments