MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 091568238583c32aeee4cd77861526a9e1689da10e45f7b3d659f8c561c48355. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 091568238583c32aeee4cd77861526a9e1689da10e45f7b3d659f8c561c48355
SHA3-384 hash: 5b99f2365815bd421d9dd94715d6b3b57a906b131e17f7b261820dd473827811b6c8dc34a7e909f22579ac97363475e1
SHA1 hash: c8861601cc73d11c9aa6c4e39e75d472f6f77e4f
MD5 hash: e19a95fbd04cd12b5bd80bfdcccabca5
humanhash: red-paris-robert-september
File name:Drawing.exe
Download: download sample
Signature Loki
Create hunting rule
File size:381'440 bytes
First seen:2023-11-13 06:38:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 6144:qUNgMgB2+63ymZeEHe1YMhY4NiPtiHDxjQPV2Yxh1EeJ3D6FW8Oq:ZXgBoymJeFhXpjxsIQNJ3Dk
Threatray 1'616 similar samples on MalwareBazaar
TLSH T1C88423098AAC77D2F1775BF0D46B7A0868809D117D1E7B6B1670B27F4F3368EB942188
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon e0c4a2a2a4bcbcf8 (15 x Loki, 12 x Formbook, 5 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
358
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/458283/
Detection(s):
SecuriteInfo.com.Malware.PDB-63.UNOFFICIAL
Create hunting rule

Win.Packed.Injuke-9993897-0
Create hunting rule

SecuriteInfo.com.Win64.TrojanX-gen.16913.24846.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a file
Сreating synchronization primitives
Reading critical registry keys
Changing a file
Creating a file in the %AppData% subdirectories
Sending a custom TCP request
Enabling the 'hidden' option for recently created files
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6551c48d946b6ab224609212/reports/9fec2976-b4c9-4208-86c5-c5b003006091/overview
Verdict:
Malicious
Labled as:
MSILHeracles.Generic
Link:
https://www.hybrid-analysis.com/sample/091568238583c32aeee4cd77861526a9e1689da10e45f7b3d659f8c561c48355
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
dotRunpeX
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2737527b-69e7-4e36-bac6-ebaa12303bf4
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1341514
Signature
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/091568238583c32aeee4cd77861526a9e1689da10e45f7b3d659f8c561c48355
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/091568238583c32aeee4cd77861526a9e1689da10e45f7b3d659f8c561c48355/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-11-28 01:22:50 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
3
AV detection:
24 of 38 (63.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bekwqi4fqpbsv3xezv3ymfjgvhqwrhnbbzc7pm6wlh4mkyoeqnkq._file
Verdict:
malicious
Similar samples:
2b0a569433b5a2f7bdccfb8f296cda74e1e4ed74b0fa9f4e7146e34c22a6a940
Loki
34607326603ce36c63cde3c1a556390d7d3430220ba5cdb3477b75d1f3b21184
Loki
4a8195f159274fb6b2edf61864824e9c686398ce60df94d23fabb21c48d57499
Loki
81278e61b365975c3ba6eb47c4734c4831e2488dfd3357cf8d0d018b4a57123f
Loki
ac1bbc53ec6158d8dfa191b81292c96d8fb106d4ea196a6bef55027e0702b6f9
Loki
b9f6f3b9202df46f9e2b996e4c47cd77ea107932712c50d300f3d0ddefa75686
Loki
dd1d02c072a5644dbbbcadc2a8b6195cd420b55a6f8ec2309d0e1682f434bdff
Loki
+ 1'606 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/231113-hem1yaah3w/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
091568238583c32aeee4cd77861526a9e1689da10e45f7b3d659f8c561c48355
MD5 hash:
e19a95fbd04cd12b5bd80bfdcccabca5
SHA1 hash:
c8861601cc73d11c9aa6c4e39e75d472f6f77e4f
Link:
https://www.unpac.me/results/c5497c48-63e8-427e-a572-58aefa3320fb/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/091568238583/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/458283/

Comments