MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a3b86845990070fa63fed00a32530b49765b5474e70e29b29889715eda8e23c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 21


Intelligence 21 IOCs 1 YARA 21 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a3b86845990070fa63fed00a32530b49765b5474e70e29b29889715eda8e23c
SHA3-384 hash: 62912dd61615b5dc135e18abecb60a5cf3bcbb8ef88c0764a025896a215a2d644f70fadeebf83a3f10291827794f94cf
SHA1 hash: 0ce088f4d71d7c056b47594cc99e931e489a3aa1
MD5 hash: 97673584c7a9d83366baff1628287abc
humanhash: seven-lamp-five-red
File name:97673584C7A9D83366BAFF1628287ABC.exe
Download: download sample
Signature Loki
Create hunting rule
File size:98'816 bytes
First seen:2025-12-02 04:40:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0239fd611af3d0e9b0c46c5837c80e09 (259 x Loki, 1 x Heodo)
ssdeep 1536:6zvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EquIzmd:hSHIG6mQwGmfOQd8YhY0/EjUG
Threatray 4'037 similar samples on MalwareBazaar
TLSH T156A32942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4504/4/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://www.tsq-hk.com/rollers/rokow3/fre.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://www.tsq-hk.com/rollers/rokow3/fre.php https://threatfox.abuse.ch/ioc/1665965/

Intelligence

File Origin
# of uploads :
1
# of downloads :
153
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
97673584C7A9D83366BAFF1628287ABC.exe
Verdict:
Malicious activity
Analysis date:
2025-12-02 04:40:48 UTC
Tags:
lokibot stealer trojan
Link:
https://app.any.run/tasks/2528251d-0c51-4f10-9d8b-0014afe29637

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
LokiBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/42089/
Detection(s):
Win.Trojan.Autoit-7057866-1
Create hunting rule

Win.Trojan.naKocTb-6331389-1
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=692e6dbc264b106bd645d052
Tags:
infosteal fareit spoof
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypt crypto evasive exploit fareit infostealer lokibot microsoft_visual_cc packed stealer stealer xor-url xpack zbot
Link:
https://www.filescan.io/uploads/692e6dbafb57498b31681321/reports/a386de72-b458-40bf-99dc-d6d597bd671c/overview
Verdict:
Malicious
Labled as:
Trojan.naKocTb
Link:
https://www.hybrid-analysis.com/sample/3a3b86845990070fa63fed00a32530b49765b5474e70e29b29889715eda8e23c
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-29T10:53:00Z UTC
Last seen:
2025-12-03T16:03:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Udochka.sb Trojan.Win32.Gorgon.sb Trojan.Win32.CMY3U.sb Trojan.Win32.Agentb.bvrg PDM:Trojan.Win32.Generic Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Fareit.sb
Link:
https://opentip.kaspersky.com/3a3b86845990070fa63fed00a32530b49765b5474e70e29b29889715eda8e23c/results?tab=lookup
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/052c3a72-12e1-4eaa-a792-4d7c7a60e39b
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1824117
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3a3b86845990070fa63fed00a32530b49765b5474e70e29b29889715eda8e23c
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/97673584c7a9d83366baff1628287abc
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3a3b86845990070fa63fed00a32530b49765b5474e70e29b29889715eda8e23c/
Verdict:
Malicious
Threat:
Family.LOKIBOT
Link:
https://tip.neiki.dev/file/3a3b86845990070fa63fed00a32530b49765b5474e70e29b29889715eda8e23c
Threat name:
Win32.Infostealer.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2025-11-29 15:06:56 UTC
File Type:
PE (Exe)
AV detection:
37 of 38 (97.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hi5ynbczsadq7jr75uakgjjqwslwlnkhjzyofgzjrclrl3ni4i6a._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
122faf1d6f561477954e08ac6a915388d9e449f77a0caa62442c5f4bf99e6083
Loki
2ee04de97c5bf6af7ba600804ea315a3598696270693cc1104bc7f6df7fdc55d
Loki
3ba90a8a015b4d1fb782b75512d710d0d3b560be39040e01bd0de2157ff140f1
Loki
701b8df01024b15c3b33a77f468345b82af01c85817ec83e6cef861ccdee3dbd
Loki
d998bd4232ffd4b1781fff28431744bec81370200abcf9c483c87af224b5622d
Loki
error
Loki
+ 4'027 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection discovery spyware stealer trojan
Link:
https://tria.ge/reports/251202-fargfswrdz/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
outlook_office_path
outlook_win_path
System Location Discovery: System Language Discovery
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Lokibot family
Malware Config
C2 Extraction:
http://www.tsq-hk.com/rollers/rokow3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Verdict:
Malicious
Tags:
stealer loki Win.Trojan.Autoit-7057866-1 lokibot
YARA:
infostealer_xor_patterns infostealer_loki malware_Lokibot_strings LokiBot Windows_Trojan_Lokibot_1f885282 Windows_Trojan_Lokibot_0f421617 STEALER_Lokibot JPCERTCC_Lokibot
Link:
https://app.threat.zone/submission/eeca5b36-6662-4876-939b-517f8ef547e2
Unpacked files
SH256 hash:
3a3b86845990070fa63fed00a32530b49765b5474e70e29b29889715eda8e23c
MD5 hash:
97673584c7a9d83366baff1628287abc
SHA1 hash:
0ce088f4d71d7c056b47594cc99e931e489a3aa1
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
lokibot
Create hunting rule
Link:
https://www.unpac.me/results/0a0a64de-ebdd-406a-b640-e5cc37f9ba37/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3a3b86845990/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/3a3b86845990070fa63fed00a32530b49765b5474e70e29b29889715eda8e23c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifacts observed in infostealers
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:LokiBot
Create hunting rule
Author:kevoreilly
Description:LokiBot Payload
Rule name:Lokibot
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:LokiPWS
Create hunting rule
Author:NDA0E
Description:Detects LokiBot
Rule name:malware_Lokibot_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:SUSP_XORed_URL_In_EXE
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:SUSP_XORed_URL_in_EXE_RID2E46
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:Windows_Trojan_Lokibot_0f421617
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Lokibot_1f885282
Create hunting rule
Author:Elastic Security
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/42089/

Comments