MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29ae352903f7640f4f6a14941a71cf30c25d52188353385da877ece30acfb4d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29ae352903f7640f4f6a14941a71cf30c25d52188353385da877ece30acfb4d3
SHA3-384 hash: 5a5cff9b7558895b864ce00b82682a3dc8b226e3901fd86dfa816803aa15040d6466f2204600979d822f0cd3977b265f
SHA1 hash: f004d516bb4a7f42239d3b953fde670d84352b9f
MD5 hash: 9868a81b4fb4ee1ec983cb37aa2e84be
humanhash: alpha-delaware-hydrogen-king
File name:9868a81b4fb4ee1ec983cb37aa2e84be
Download: download sample
Signature Loki
Create hunting rule
File size:61'440 bytes
First seen:2020-11-17 12:40:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 24d521a9ced4e83546d3fe0326ccb9ef (4 x Loki, 1 x GuLoader)
ssdeep 384:G3TPsQmFA46iw0UHYr3ad7LVkUY63jhj+6XULs9Qnun1IU9PnmwNHPgl+:GjkQdT0UHYrKd7zVjRHkw9d/9PFBPgl
Threatray 595 similar samples on MalwareBazaar
TLSH 2D533B07F78C8429DF8B01711C9DD3BC11D4BC618954BE8767883EDE1EB06651A83FAA
Reporter seifreed
Tags:Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Midie-9790834-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
DNS request
Connection attempt
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/29ae352903f7640f4f6a14941a71cf30c25d52188353385da877ece30acfb4d3/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 01:08:10 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fgxdkkid65sa6t3kcskbu4opgdbf2uqyqnjtqxnio7wogcwpwtjq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
01e45e2c243f5384661dab978cc7435346bda61223b5c921cdd079ed44210387
Loki
17653f0b95df006bc5833a71a7cedaf0210ab2dd9c913104576b4823c8f7cdfd
Loki
2f99de0c12f67f877e1944d5bc6f889ff9013fb7e902b91260f4bdc952959d7e
Loki
88c0ef97b6edb3f676523e57ee95a23604efc28ef3a9db916c2123c793b44571
Loki
b8c463fc8f8137444b55e4cc24564f539bfe17956a7dde1e4cef2a1d3b9a2856
Loki
b97f89957de59d3a218ed617e6acb9136e3279f9dec3f864ec32d9b29b77ec6e
Loki
cec2f9996977f945ffbdd5624170b6e1daa151aaab1e5d9aea7a5566f5197dde
Loki
d3e8b7ec008c3b5a14ac57fe76b4a53eb4a1b90ab28d38effd051317b2a9fea7
Loki
d74ec4c8e4b38d5258d5fcee7364b8dd0eeb165e6b0aa3edc544b160ceec7f89
Loki
d8fffa9f88a85c5e0e5344ee431e15c53f9d610019f0746d7a374f59f753593c
Loki
+ 585 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201117-v284ghehde/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
29ae352903f7640f4f6a14941a71cf30c25d52188353385da877ece30acfb4d3
MD5 hash:
9868a81b4fb4ee1ec983cb37aa2e84be
SHA1 hash:
f004d516bb4a7f42239d3b953fde670d84352b9f
Link:
https://www.unpac.me/results/377a78ee-85b9-4cff-ba43-acbd5b83b879/
SH256 hash:
49b04162c412105ab0857de16713724cbf3234a0b6ba51f3a5286312633f20c3
MD5 hash:
1f1b425190b2fb0396ad2d538b1060ba
SHA1 hash:
413f98641d46fdcabfcaf64f29495667de6282ea
Link:
https://www.unpac.me/results/377a78ee-85b9-4cff-ba43-acbd5b83b879/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments