MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9d1b551c4bf7bca9c2b2006acaa9b7f4571fa16b469c1bab4d4e260d2a908ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9d1b551c4bf7bca9c2b2006acaa9b7f4571fa16b469c1bab4d4e260d2a908ad
SHA3-384 hash: 8e28804baf6b65f0d112893b8dbef8416aa5b9140bfbe50389aa906a68f9f8dd29abcef7d45bc9ed45c9089ab3e1b3c6
SHA1 hash: 7afbaa1e3db21b61370245970c12f3eaec23490b
MD5 hash: 923a08446eeacbdc837e0e26754ac55c
humanhash: fish-kitten-low-eighteen
File name:win32(12).exe
Download: download sample
File size:273'229 bytes
First seen:2020-06-02 12:10:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c2c71dfce9a27650634dc8b1ca03bf0 (160 x Loki, 58 x Formbook, 55 x Adware.Generic)
ssdeep 6144:RPCganNgt7p3aeUrEDg2Ic6N++MecZMOAJPVFOletgjNAnGDJ/DWA/UAiY3psSQ:PanSt7p3a7+Ec6pBwMOAJPVFOTLDpV1q
Threatray 679 similar samples on MalwareBazaar
TLSH 3A441207B7708097C6A252721FAF5E3A9EAA63792726573F4B452F18BC523054F1F283
Reporter oppimaniac

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

PUA.Win.Adware.Browserio-6725861-0
Create hunting rule

SecuriteInfo.com.Artemis162931E90DCF.4593.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 12:37:26 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
0e4c5cf2d1d60e4931c7af6021073006379935d688f5f55ad21fb29844d75a5a
0f24e222f76b19a0f1995c70e3711ab2b1c7e3f41c5e915796e767fce361e2e3
3c81bde8d413cadc04efa32c2754918d4a1a9c43a60181e7907cca8d31107826
3d8cf478e496182ae32a54994a79720e6b5d79e0237e14287290fec3b22fe0bb
581ccb74a37077703bcc314447ce7dfeec42832bad81225f1be6c214ca9bf51d
5c63c2887891a56e0465251c8112ce7a07fc70e782dbc2e80f45f670294d4285
5e23eed104a5bd67c8ae3abe1f3554abac8500bf9f916992df36246b06f14419
7ef7ff0660d406b237fd3253738d60a294c0273ca1436cf9ba87d5b2ea8d62d8
9f06ce1718cfa4e73366f82c9488b7a4aad4ddede7d7b3b51d44667607a3961c
c2f42cfcfafad77546d57cbfde6a6f4c1c75d684a81304d1ec901285b1873bd3
+ 669 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/201109-6qbkvdlfk6/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Loads dropped DLL
Blacklisted process makes network request
Lokibot
Malware Config
C2 Extraction:
http://1filesharing.ga/loky4/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe b9d1b551c4bf7bca9c2b2006acaa9b7f4571fa16b469c1bab4d4e260d2a908ad

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/373100/
  
Delivery method
Distributed via web download

Comments