MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1bc87c4f205cd112b2cec3f67c577ae7b604ed56c6cd6a15d8ad1ae6438598b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 21


Intelligence 21 IOCs 1 YARA 31 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1bc87c4f205cd112b2cec3f67c577ae7b604ed56c6cd6a15d8ad1ae6438598b8
SHA3-384 hash: de8fe6e9afcc637db4bfb210c71a30718ca4ed3ad316e7c02a96e0c56fa314955351cff1dcad2d73b1c23d9dae05996f
SHA1 hash: 4815ffb346727ccf3ceb6cf5d0f03158209f883d
MD5 hash: 1e8b10fdcf06a6305fb7bf0e80e3c4a2
humanhash: hotel-zulu-louisiana-kansas
File name:1e8b10fdcf06a6305fb7bf0e80e3c4a2.exe
Download: download sample
Signature Loki
Create hunting rule
File size:1'273'856 bytes
First seen:2025-09-12 23:30:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 356f908c1b0cd139f4a1e44528f97d0c (4 x Loki)
ssdeep 24576:hReuectp9dCDX0wtJ+VHo2qFSasuIGD/zOX6WXaaKjhZZSY:h7CT3aRgSaJIIM6WUjhZZj
Threatray 716 similar samples on MalwareBazaar
TLSH T1D9459E13B7C3C1A6DFA20AB2D47543371E79BCA0173C9ACB6641342EE871ED06A75B58
TrID 52.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
22.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
7.5% (.EXE) Win64 Executable (generic) (10522/11/4)
4.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
dhash icon ccdaece2fae4b2b0 (4 x Loki)
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://pakarabi.net/loki/Panel/five/fre.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://pakarabi.net/loki/Panel/five/fre.php https://threatfox.abuse.ch/ioc/1588772/

Intelligence

File Origin
# of uploads :
1
# of downloads :
389
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
1e8b10fdcf06a6305fb7bf0e80e3c4a2.exe
Verdict:
Malicious activity
Analysis date:
2025-09-12 23:30:47 UTC
Tags:
lokibot stealer trojan auto-sch-xml
Link:
https://app.any.run/tasks/b4969620-649e-4856-a803-a3754568531b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/27254/
Detection(s):
Win.Dropper.ImminentMonitorRAT-9965568-0
Create hunting rule

Win.Dropper.ImminentMonitorRAT-9965570-0
Create hunting rule

Win.Packed.ImminentMonitorRAT-9965578-0
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68c4ad4ad49ea3f1e4b4d9a1
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Moving a recently created file
Creating a process from a recently created file
Launching a process
Searching for synchronization primitives
Сreating synchronization primitives
Sending a custom TCP request
Unauthorized injection to a recently created process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context fingerprint keylogger lolbin microsoft_visual_cc obfuscated schtasks threat
Link:
https://www.filescan.io/uploads/68c4ad3ddbc6f5a29c42d34c/reports/45135cb3-43f7-4f6e-adc8-31155e4e0584/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/1bc87c4f205cd112b2cec3f67c577ae7b604ed56c6cd6a15d8ad1ae6438598b8
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-11T11:18:00Z UTC
Last seen:
2025-09-11T11:18:00Z UTC
Hits:
~10
Detections:
Backdoor.Androm.TCP.C&C Backdoor.Androm.HTTP.Notification Trojan-PSW.Win32.Stealer.sb Trojan-Dropper.MSIL.Agent.seshvd Trojan.Win32.Gorgon.sb HEUR:Trojan.Win32.Generic Trojan-Dropper.MSIL.Agent.avnd Backdoor.Androm.HTTP.C&C Trojan.Win32.AutoHK.mp Trojan.MSIL.Crypt.sb Backdoor.MSIL.Agent.yao PDM:Trojan.Win32.Generic Backdoor.Androm.HTTP.ServerRequest UDS:DangerousObject.Multi.Generic VHO:Trojan.MSIL.Exnet.gen Trojan-PSW.Fareit.HTTP.C&C PDM:Backdoor.Win32.Generic Trojan-PSW.Win32.Fareit.sb Trojan-Dropper.Win32.Agent.sb VHO:Backdoor.MSIL.Agent.gen
Link:
https://opentip.kaspersky.com/1bc87c4f205cd112b2cec3f67c577ae7b604ed56c6cd6a15d8ad1ae6438598b8/results?tab=lookup
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8ca54483-2f57-4a82-802e-1d364a42901d
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1776803
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Found malware configuration
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample or dropped binary is a compiled AutoHotkey binary
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1776803 Sample: PNEUOJyQhF.exe Startdate: 13/09/2025 Architecture: WINDOWS Score: 100 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 Antivirus detection for URL or domain 2->46 48 9 other signatures 2->48 8 PNEUOJyQhF.exe 5 2->8         started        12 Svchostt.exe 2 2->12         started        process3 file4 32 C:\Users\user\AppData\...\Svchostt.exe (copy), PE32 8->32 dropped 34 C:\Users\user\AppData\Local\Svchostt-t.exe, PE32 8->34 dropped 36 C:\Users\user\AppData\Local\Svchost.Text, PE32 8->36 dropped 38 C:\Users\user\AppData\Local\MCconfig.dll, PE32 8->38 dropped 50 Contains functionality to register a low level keyboard hook 8->50 52 Sample or dropped binary is a compiled AutoHotkey binary 8->52 14 Svchostt-t.exe 5 8->14         started        18 Svchostt.exe 3 8->18         started        20 Svchostt.exe 12->20         started        signatures5 process6 file7 40 C:\Users\user\AppData\Local\x, XML 14->40 dropped 54 Antivirus detection for dropped file 14->54 56 Multi AV Scanner detection for dropped file 14->56 58 Uses schtasks.exe or at.exe to add and modify task schedules 14->58 22 schtasks.exe 1 14->22         started        24 Svchostt.exe 18->24         started        26 WerFault.exe 4 20->26         started        signatures8 process9 process10 28 conhost.exe 22->28         started        30 WerFault.exe 2 24->30         started       
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1bc87c4f205cd112b2cec3f67c577ae7b604ed56c6cd6a15d8ad1ae6438598b8
Gathering data
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1bc87c4f205cd112b2cec3f67c577ae7b604ed56c6cd6a15d8ad1ae6438598b8/
Verdict:
Malicious
Threat:
Family.LOKIBOT
Link:
https://tip.neiki.dev/file/1bc87c4f205cd112b2cec3f67c577ae7b604ed56c6cd6a15d8ad1ae6438598b8
Threat name:
Win32.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-09-10 06:06:38 UTC
File Type:
PE (Exe)
Extracted files:
23
AV detection:
23 of 38 (60.53%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dpehytzaltirfmwoyp3hyv32463aj3kwy3gwufoyvunomq4ftc4a._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
admintool_autohotkey
Create hunting rule
Similar samples:
007ee67c4bec255a19ab2b6fa0f159e9d9636c74dde34f9ddbf3b45ced74cebe
Loki
00b9e38547c85e5944e829d5f327a722c6426ce94e62223ea5ac2aa89a47ea3f
Loki
1bc87c4f205cd112b2cec3f67c577ae7b604ed56c6cd6a15d8ad1ae6438598b8
Loki
5d7f0011fe14d2f595df1f8630724d010b68d959d65bd06ca7f72864adebd125
Loki
851ef61affd9a6654b5a635e34bd678226e26aece30aafbb7ab2d3947d5057c6
Loki
9fa5354df45e7167f7dfe8640c1fc9be421d9733a1982d5eb550ca9c7a9525db
Loki
cb90ff94822154b2ec1bc9e9fd11bd64bcb77c84896bc01e3952e44f45ec75e3
Loki
error
Loki
f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc
Loki
+ 706 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection discovery execution persistence spyware stealer trojan
Link:
https://tria.ge/reports/250912-3hrhrahq9t/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Lokibot
Lokibot family
Malware Config
C2 Extraction:
http://pakarabi.net/loki/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Verdict:
Malicious
Tags:
Win.Dropper.ImminentMonitorRAT-9965568-0 lokibot
YARA:
n/a
Link:
https://app.threat.zone/submission/e21a0fc5-159a-44b8-a6b7-edfd961d1e10
Unpacked files
SH256 hash:
552fd2d5ed44515506c0ab87da49a65d6c2c301bd40911ebbf0456a1804bb34c
MD5 hash:
c4d243e47796fdc9feab34f4cf29e800
SHA1 hash:
3070ea2bb07abba4c053154f63410af267c9473a
Link:
https://www.unpac.me/results/324b14dc-8e68-4a25-8ce4-7df9848d429b/
SH256 hash:
6d3c2217b8d283fa208b146e1642fc51eccac9c56dc1792a08e58701fef8c442
MD5 hash:
cc825d825390e09f0c21dcdea486ab81
SHA1 hash:
18cd9c68d4a14f7da3a1ad07f6843603dde40c9f
Link:
https://www.unpac.me/results/324b14dc-8e68-4a25-8ce4-7df9848d429b/
SH256 hash:
bbee34359e7e473e25a1962b9a345e7e68893369f2271b6adcd6ea4811bec9a1
MD5 hash:
a792765c889fe968823e16946e2a361d
SHA1 hash:
3d33a579a17fb9d0d23b292dfe9d6639d37b6dc7
Link:
https://www.unpac.me/results/324b14dc-8e68-4a25-8ce4-7df9848d429b/
SH256 hash:
f99710ff79652237bb2bb8846f64791a1f099ce6b2b7a87f6632f638752c893b
MD5 hash:
ca8f3dbd9c5af06b5d417dc14c0a3a49
SHA1 hash:
6635fab748796c3bdcf362d2201c40126d4b17dc
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
lokibot
Create hunting rule
STEALER_Lokibot
Create hunting rule
SUSP_XORed_URL_In_EXE
Create hunting rule
Lokibot
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Link:
https://www.unpac.me/results/324b14dc-8e68-4a25-8ce4-7df9848d429b/
Parent samples :
cb90ff94822154b2ec1bc9e9fd11bd64bcb77c84896bc01e3952e44f45ec75e3
1bc87c4f205cd112b2cec3f67c577ae7b604ed56c6cd6a15d8ad1ae6438598b8
b812cdb8e88e818a206ac067adbc9017ea3dcedb19544493858247a0cfa591dc
dc09d93c6815646ab07908d02c810efd668179f2fb43237c588657171f06a762
SH256 hash:
e5936d703244284a84aaa908a68bf9fdf322d754cb4522c6956d45b19bf1f2a9
MD5 hash:
ba4d3a01b8dd96db39ec4ecb683b4bdc
SHA1 hash:
fa16213e286299493093d1be0daf26f5e2f1809a
Link:
https://www.unpac.me/results/324b14dc-8e68-4a25-8ce4-7df9848d429b/
SH256 hash:
1bc87c4f205cd112b2cec3f67c577ae7b604ed56c6cd6a15d8ad1ae6438598b8
MD5 hash:
1e8b10fdcf06a6305fb7bf0e80e3c4a2
SHA1 hash:
4815ffb346727ccf3ceb6cf5d0f03158209f883d
Link:
https://www.unpac.me/results/324b14dc-8e68-4a25-8ce4-7df9848d429b/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1bc87c4f205c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1bc87c4f205cd112b2cec3f67c577ae7b604ed56c6cd6a15d8ad1ae6438598b8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifacts observed in infostealers
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:LokiBot
Create hunting rule
Author:kevoreilly
Description:LokiBot Payload
Rule name:LokiPWS
Create hunting rule
Author:NDA0E
Description:Detects LokiBot
Rule name:malware_Lokibot_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:SUSP_XORed_URL_In_EXE
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:SUSP_XORed_URL_in_EXE_RID2E46
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Windows_Trojan_Lokibot_0f421617
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Lokibot_1f885282
Create hunting rule
Author:Elastic Security
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/27254/

Comments