MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d611ca54f64546327d9bc6993662d5058a7f07fa8e16b81fc7ee6ff60d952f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	3d611ca54f64546327d9bc6993662d5058a7f07fa8e16b81fc7ee6ff60d952f2
SHA3-384 hash:	fe6b6879e885536ab7e2b1bbf3ded5c9e924897d4065be1f69716b3c34633da3e5c6d4ba19102d035ef9c6023c68beb0
SHA1 hash:	cee33cfb8ad0380d6aaa1272e3a1e5474f2d5b59
MD5 hash:	d7e5cae47982fe6cee9a60426d9b6e1a
humanhash:	wolfram-oklahoma-stairway-mango
File name:	Remittance ADVICE.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	1'139'712 bytes
First seen:	2020-05-29 06:17:03 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep	24576:htb20pkaCqT5TBWgNQ7abu0XneiqWUWJLPtZ6A:yVg5tQ7abfnCWUWB35
Threatray	2'338 similar samples on MalwareBazaar
TLSH	4D35CF1373DE8361C7B25273BA15B701AE7F782506B5F96B2FD8093DE920122521EA73
Reporter	jarumlus
Tags:	Loki

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Injector

Status:

Malicious

First seen:

2020-05-28 23:02:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 31 (70.97%)

Threat level:

5/5

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot spyware stealer trojan

Link:

https://tria.ge/reports/201109-qdxfvw4tcs/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetThreadContext

Lokibot

Malware Config

C2 Extraction:

http://superson.ga/Bobby/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.