MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1b807ffbeb2c12281c41e785d314744777a47c2582cdb9ce677dac07fefca04. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 2 File information 4 Yara 4 Comments

SHA256 hash: d1b807ffbeb2c12281c41e785d314744777a47c2582cdb9ce677dac07fefca04
SHA3-384 hash: 2b46eb59a8b83f278999e0fc1ac995bde7ea7c0906aa44ddd7edae0fe048e99357e2be83335e0a584fb2ee32418bd0e6
SHA1 hash: 6590b35b5d9ab56010c328a1f90db1922cb0a002
MD5 hash: ef293bca8f54b6e410197f21a473036b
humanhash: low-four-robin-stream
File name:Consignment Details_pdf.exe
Download: download sample
Signature Loki
File size:280'064 bytes
First seen:2020-06-30 08:41:52 UTC
Last seen:2020-06-30 09:59:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 3072:JqhNOcX8Xb3K5seGlGLeQJdATPTVWZV5wx3nu9B6jFT5g89BZ67I:+OXbAs3qH+PTa7wx36AjhS8XZq
TLSH C0546C29B291D43DC37A4972752568E296B8BE323E02C70F72C3531C1D112DAEF6679B
Reporter @jarumlus


Mail intelligence
Trap location Impact
Global Low
CH Switzerland Low
# of uploads 2
# of downloads 33
Origin country US US
CAPE Sandbox Detection:Loki
CERT.PL MWDB Detection:lokibot
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Razy
First seen:2020-06-30 00:13:00 UTC
AV detection:25 of 31 (80.65%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   10/10
Malware Family:lokibot
Tags:spyware trojan stealer family:lokibot
Config extraction:
VirusTotal:Virustotal results 40.28%

Yara Signatures

Rule name:Lokibot
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:win_lokipws_auto
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_lokipws_g0
Author:Slavo Greminger, SWITCH-CERT
Rule name:with_sqlite
Author:Julian J. Gonzalez <>
Description:Rule to detect the presence of SQLite data in raw image

File information

The table below shows additional information about this malware sample such as delivery method and external references.



Executable exe d1b807ffbeb2c12281c41e785d314744777a47c2582cdb9ce677dac07fefca04

(this sample)

Delivery method
Distributed via e-mail attachment