MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46f8195b1f60937111b90f46810c3f73ae138a7205a8cdcb3d99483c8d2fdc71. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 2 File information 4 Yara 3 Comments

SHA256 hash: 46f8195b1f60937111b90f46810c3f73ae138a7205a8cdcb3d99483c8d2fdc71
SHA3-384 hash: 3ae06aece01b6029920308e5d27603da192f610780e48958b2de7097d1083100842917c88eb4eee0070f2b0c53c8c579
SHA1 hash: 12e350b58824001336589e3f042a145499ce39e6
MD5 hash: 6f9ec1852536a316d392172f0eaae385
humanhash: idaho-cardinal-video-three
File name:jkkstb.exe
Download: download sample
Signature Loki
File size:605'184 bytes
First seen:2020-06-30 05:48:42 UTC
Last seen:2020-06-30 07:01:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 24f26e153c9b6068c0a4770547eb6d9e
ssdeep 12288:0CbpcLhilrm7G8oclWEAroCo3DQmTPVV5eR2:7uLhi80Jro7j5eR2
TLSH 6BD48E12E7AC443FF072363D9D2B56BC9826BD53392C59472BE4DC4C6F396823926287
Reporter @abuse_ch
Tags:exe geo KOR Loki

Malspam distributing Loki:

Sending IP:
From: 지존2 <>
Subject: 유티아이테크-발주서 송부의건
Attachment: (contains "jkkstb.exe")


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 35
Origin country US US
CAPE Sandbox Detection:Loki
ClamAV PUA.Win.Adware.Slugin-6803969-0
CERT.PL MWDB Detection:lokibot
ReversingLabs :Status:Malicious
Threat name:Win32.Trojan.Injector
First seen:2020-06-30 05:50:08 UTC
AV detection:29 of 31 (93.55%)
Threat level:   5/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   10/10
Malware Family:lokibot
Tags:spyware trojan stealer family:lokibot
Config extraction:
VirusTotal:Virustotal results 45.83%

Yara Signatures

Rule name:Lokibot
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:win_lokipws_auto
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Author:Julian J. Gonzalez <>
Description:Rule to detect the presence of SQLite data in raw image

File information

The table below shows additional information about this malware sample such as delivery method and external references.



Executable exe 46f8195b1f60937111b90f46810c3f73ae138a7205a8cdcb3d99483c8d2fdc71

(this sample)

Delivery method
Distributed via e-mail attachment