MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a440dca4a1559d04426c05899989e611bd77d55b3fe00713b70e1b4968c8f61b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 2 File information 3 Yara 3 Comments

SHA256 hash: a440dca4a1559d04426c05899989e611bd77d55b3fe00713b70e1b4968c8f61b
SHA3-384 hash: 430c8d7e28321439592cf1d148aeedf0bdce0691e0c4bf6425c3073bdd8fb42cc9436b558f2ec95f226db08ebe91584e
SHA1 hash: 4ddda3e0700098a0dd64c44f78a5e2166b47d395
MD5 hash: 0207edc8cf65c2e87d4ce3e72cf4ad1f
humanhash: washington-finch-mobile-oranges
File name:Bank Reciept.exe
Download: download sample
Signature Loki
File size:214'528 bytes
First seen:2020-06-30 05:56:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 6144:uIzlLsikvWRElcvZqrNp+HLVwX1S9ClbN:uIzlAPvWXxgn+pyIEJN
TLSH 1124E035237C572AD6FE9BB874B108100FF1B51B6661E32C6E9461CE2937B40EA21F67
Reporter @abuse_ch
Tags:exe Loki

Malspam distributing Loki:

Sending IP:
From: Alexandr Gutov <>
Subject: RE: (Urgent) Vessel_5748- Arrest on court Order
Attachment: Shipping (contains "Bank Reciept.exe")

Loki C2:


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 35
Origin country US US
CAPE Sandbox Detection:n/a
CERT.PL MWDB Detection:lokibot
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Androm
First seen:2020-06-30 05:58:05 UTC
AV detection:22 of 31 (70.97%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   10/10
Malware Family:lokibot
Tags:spyware trojan stealer family:lokibot
Config extraction:
VirusTotal:Virustotal results 11.11%

Yara Signatures

Rule name:Lokibot
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:win_lokipws_auto
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Author:Julian J. Gonzalez <>
Description:Rule to detect the presence of SQLite data in raw image

File information

The table below shows additional information about this malware sample such as delivery method and external references.



Executable exe a440dca4a1559d04426c05899989e611bd77d55b3fe00713b70e1b4968c8f61b

(this sample)

Dropped by
MD5 7aa7460001c474522910069f6283ef1f
Delivery method
Distributed via e-mail attachment