🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3420a7b543b869970d669c3b79c9f20478d25dd4e1a31cba69c5e841487f0fa6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3420a7b543b869970d669c3b79c9f20478d25dd4e1a31cba69c5e841487f0fa6
SHA3-384 hash: 500586a0da6b45e1b2ce4d5dac7cba1d875e4d015955bcfebdb59715a7ce970cf7e1b4928769de037f908b03a758e080
SHA1 hash: 146084eb04a4c0d66575d0896827abc83069e864
MD5 hash: 4ffc3543a852763f585b63f5f9a0d58f
humanhash: alaska-mike-sink-nine
File name:VTE_Filter_Transaction_Report_and_Payment_Plan_pdf.exe
Download: download sample
Signature Loki
Create hunting rule
File size:77'824 bytes
First seen:2020-03-20 06:33:00 UTC
Last seen:2020-03-20 08:30:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b9f87cfa1847bd5416577231c997e229 (1 x Loki)
ssdeep 768:F1sXeWTFFqvh16mTX4bSAAEvUcTkm6SZmAQTwT711/4t1sAYFM17vGx4:FoR5M516EIOAAERTkmEAQcH/2eee
TLSH 3C738D43F2B0E826D49DCB3D3C4AD7D01127BD652981E68B36D47B5F68F40A38E4EA19
Reporter jarumlus
Tags:Loki Lokibot

Intelligence

File Origin
# of uploads :
2
# of downloads :
270
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader33.18779.26056.24759.UNOFFICIAL
Create hunting rule

Win.Trojan.Vebzenpak-7639494-0
Create hunting rule

Win.Trojan.Vebzenpak-7639767-0
Create hunting rule

Win.Trojan.Generic-7640133-0
Create hunting rule

Win.Trojan.Vebzenpak-7640209-0
Create hunting rule

Win.Trojan.Vebzenpak-7699953-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-03-19 14:24:24 UTC
AV detection:
27 of 30 (90.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gqqkpnkdxbuzodlgtq5xtspsar4nexou4grrzotjyxuecsd7b6ta._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
guloader
Create hunting rule
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3420a7b543b869970d669c3b79c9f20478d25dd4e1a31cba69c5e841487f0fa6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::EVENT_SINK_AddRef

Comments