MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1278f7bac9eea48b94dc7f05a7cba9fcc4aca109875ccb8a8d3fd69bbb967d3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 19


Intelligence 19 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1278f7bac9eea48b94dc7f05a7cba9fcc4aca109875ccb8a8d3fd69bbb967d3c
SHA3-384 hash: be4b35d10641cb324654db484a95eec43e3498aaa1419b553a328704ac011bc04dae2d70eb8eef61392b82489d073a61
SHA1 hash: 64186967d3058a59d8419a787a81af284fa9b5ab
MD5 hash: 441ded56ce56c47bf81f0f1b42976cc6
humanhash: dakota-asparagus-harry-moon
File name:1278f7bac9eea48b94dc7f05a7cba9fcc4aca109875ccb8a8d3fd69bbb967d3c
Download: download sample
Signature Loki
Create hunting rule
File size:503'296 bytes
First seen:2026-02-05 14:58:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'819 x AgentTesla, 19'743 x Formbook, 12'286 x SnakeKeylogger)
ssdeep 12288:9pY6I42RnwFj9vQv3GMTr+dVBQW6meWrJwlxJCm:IfwFZvQv3n+dJZfwW
Threatray 4'426 similar samples on MalwareBazaar
TLSH T16FB4F194626DCF12E1BA0BF319B1E27103B57D6EAC20E34D8EDA6CCB3025B525D90767
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/96942601-2c29-4ddf-958d-fd18140e399a/
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
QuarantineMessage (3).zip
Verdict:
Malicious activity
Analysis date:
2026-01-12 03:44:17 UTC
Tags:
arch-exec susp-attachments attachments attc-unc stealer lokibot auto-sch-xml trojan
Link:
https://app.any.run/tasks/2b3f27f6-5aff-4d26-8c17-dd85b00ca171

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
LokiBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/51840/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6984b013ae5379bb6609bdfc
Tags:
infosteal trojan agent virus
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
krypt packed
Link:
https://www.filescan.io/uploads/6984b006981ff1d38a49fd73/reports/9615ea1d-a438-40a2-989d-45435221a2a4/overview
Verdict:
Malicious
Labled as:
Genie.8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/1278f7bac9eea48b94dc7f05a7cba9fcc4aca109875ccb8a8d3fd69bbb967d3c
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-08T03:47:00Z UTC
Last seen:
2026-02-04T11:35:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/1278f7bac9eea48b94dc7f05a7cba9fcc4aca109875ccb8a8d3fd69bbb967d3c/results?tab=lookup
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/311c384a-79a5-42cf-85a7-decc93aed68c
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1278f7bac9eea48b94dc7f05a7cba9fcc4aca109875ccb8a8d3fd69bbb967d3c
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.46 Win 32 Exe x86
Link:
https://app.malva.re/file/441ded56ce56c47bf81f0f1b42976cc6
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1278f7bac9eea48b94dc7f05a7cba9fcc4aca109875ccb8a8d3fd69bbb967d3c/
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-01-08 07:18:44 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
22 of 36 (61.11%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cj4ppowj52sixfg4p4c2ps5j7tckziijq5omxcunh7ljxo4wpu6a._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
3abce3ec21be7d5fd6d151a46920c1051a680a2c7a4900737545b62887d890b1
Loki
b0cf41eaffcc2c22c866c4cb721d763021898f74f1bdf35d4ae2711f6edf327b
Loki
ce8bb22be29d0043943e2a2a0516d6138aae58dafcd9ad76236a4510e693d9f0
Loki
d4fadd4ee8d3864f9a07149decba872260789b39654db894c95ea23e16ede112
Loki
+ 4'416 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection discovery execution persistence spyware stealer trojan
Link:
https://tria.ge/reports/260205-sca9gagv7b/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Executes dropped EXE
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Lokibot
Lokibot family
Malware Config
C2 Extraction:
http://198.23.177.219/siu/pin.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
1278f7bac9eea48b94dc7f05a7cba9fcc4aca109875ccb8a8d3fd69bbb967d3c
MD5 hash:
441ded56ce56c47bf81f0f1b42976cc6
SHA1 hash:
64186967d3058a59d8419a787a81af284fa9b5ab
Link:
https://www.unpac.me/results/e50b6705-c345-4d41-a873-46b5c43de87b/
SH256 hash:
4778b77c5c543e7bca9173becb5b811ebfff3cb35238a934664f9571c3e17a8c
MD5 hash:
3370f9b232249d2c63bfc28f181695c5
SHA1 hash:
1cbebb49fd4ebb1110eaa173fb258336dec808c8
Link:
https://www.unpac.me/results/e50b6705-c345-4d41-a873-46b5c43de87b/
SH256 hash:
2c0d291fb20a05135335d440a9e35ecb0cd81fd4c03478cebcb37372e25cb0a0
MD5 hash:
d5b846d6eaf32dd2acb1514e85dcb1fe
SHA1 hash:
8db0220452ace823ffde18eba4cfa518c12fad2a
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/e50b6705-c345-4d41-a873-46b5c43de87b/
SH256 hash:
66ac76279add4b34db1e7567b2edca29d83a7c1f15a041b9bafdb58d590cd4fb
MD5 hash:
0e1e27387e63734371165694378214eb
SHA1 hash:
8f26a9b313732e64d826585e08a82d7b7a19afad
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
lokibot
Create hunting rule
STEALER_Lokibot
Create hunting rule
SUSP_XORed_URL_In_EXE
Create hunting rule
Lokibot
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Link:
https://www.unpac.me/results/e50b6705-c345-4d41-a873-46b5c43de87b/
Parent samples :
ce8bb22be29d0043943e2a2a0516d6138aae58dafcd9ad76236a4510e693d9f0
471745261953e9374e2ce9e42fc725ac1f59add047252e377aed07bbb6fd36a6
87074659e5cfae42bb2b9e475b95d9c5d729d298ac80be029f3453b853aa0cc2
b89bbec1c1aa51c0cdcafa77da51ed70c0daac03e31d4e06a2659036c5d9f2bf
3972158babfa442f37cb87d065bbaf55d52f063267c95d6c19fc9435f31160de
1278f7bac9eea48b94dc7f05a7cba9fcc4aca109875ccb8a8d3fd69bbb967d3c
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1278f7bac9ee/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1278f7bac9eea48b94dc7f05a7cba9fcc4aca109875ccb8a8d3fd69bbb967d3c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/51840/

Comments