MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 083e03351add27c498b79c922caf10b558525ecbd50539540059d66bd526b762. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	083e03351add27c498b79c922caf10b558525ecbd50539540059d66bd526b762
SHA3-384 hash:	7b93e03a44c82efdc62e094319707aeabf4f5ebcfe74c0440109861922ac0c46b3b464c8b3a16c8d5ce7089f7adcd966
SHA1 hash:	56143ffc80df5ed9017ed0c5c8d5b7f5deaf1754
MD5 hash:	ee7fb9a8998b39dee265b929e89d8027
humanhash:	ceiling-april-carpet-seven
File name:	ee7fb9a8998b39dee265b929e89d8027.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	109'788 bytes
First seen:	2021-02-02 17:02:29 UTC
Last seen:	2021-02-02 18:40:55 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	3072:Ax0PiFAVR/XhG0oPQFbvIWxFMtDqxmpxCBSOzydq:AxSoM/Xo0oPobrBSW
TLSH	92B30785238C9F66F39BA735732352534B51690332BF4BA4E931275A38A2F805F63B53
Reporter	abuse_ch
Tags:	exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

166

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DLAgent02

Link:

https://www.capesandbox.com/analysis/115203/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Siggen2.61322.20423.12305.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/596965

Signature

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/083e03351add27c498b79c922caf10b558525ecbd50539540059d66bd526b762/

Threat name:

ByteCode-MSIL.Backdoor.Androm

Status:

Malicious

First seen:

2021-02-02 17:03:07 UTC

AV detection:

15 of 28 (53.57%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ba7agni23ut4jgfxtsjczlyqwvmfexwl2uctsvaalhlgxvjgw5ra._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/210202-7ptg2ja8zx/

Unpacked files

SH256 hash:

083e03351add27c498b79c922caf10b558525ecbd50539540059d66bd526b762

MD5 hash:

ee7fb9a8998b39dee265b929e89d8027

SHA1 hash:

56143ffc80df5ed9017ed0c5c8d5b7f5deaf1754

Link:

https://www.unpac.me/results/d7438177-11f2-40b0-89bf-05c5eb961f81/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/083e03351add27c498b79c922caf10b558525ecbd50539540059d66bd526b762

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MALWARE_Win_DLAgent02 Create hunting rule
Author:	ditekSHen
Description:	Detects known downloader agent downloading encoded binaries in patches from paste-like websites, most notably hastebin