🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44b1379e76dff2816e6d06838723fbe603e5f671aad06a45cafb26922e7fd17e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44b1379e76dff2816e6d06838723fbe603e5f671aad06a45cafb26922e7fd17e
SHA3-384 hash: b52bc32ecb65ae5649e54ba5df6c36a61315d7067170361a4d40d9683441e2dc50aee8da17876785e9d7401d0fa9e6f2
SHA1 hash: e3da12c164bb5e5b6de0aa065156920d29b345d8
MD5 hash: e9f5f28c3ab816be065e09750aa4d7d5
humanhash: massachusetts-enemy-don-lithium
File name:44b1379e76dff2816e6d06838723fbe603e5f671aad06a45cafb26922e7fd17e.exe
Download: download sample
Signature Loki
Create hunting rule
File size:1'418'240 bytes
First seen:2020-03-22 13:33:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:utb20pkaCqT5TBWgNQ7a6/X2QtTh2am3S/T4JHnz5a16A:bVg5tQ7a6/XTtT0amkTazc5
Threatray 2'072 similar samples on MalwareBazaar
TLSH 7F65DF1363DD8364C37E5273BA157701AE7B782506A1F8FB2FE8093CA9601614E1E66F
Reporter JoulK
Tags:exe Loki Lokibot

Intelligence

File Origin
# of uploads :
1
# of downloads :
430
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-03-13 15:35:24 UTC
AV detection:
25 of 30 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=isytphtw37zic3tna2byoi734yb6l5trvligurok7mtjelt72f7a._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
1b15ef17ccb1a99c3953f61de01ebceaeef2277b3b5939408050dc7c1010d1bb
Loki
4d42868a3dbc835f6c25856f51ca721a2e7eac4c9a775c67029b831ffed156cc
Loki
6266401f72539a6707cd55f3e277f6f878e8826af0f2944f7538319c08adc9e7
Loki
790ddf3ff510253b5db189de93fb5e43fadc838d1c254d1d7f5236473e43526a
Loki
89f5773de397e09275d7d02812ec937343e878030232964061bb6aafdea5ccde
Loki
ba16a65c18b43738c394c42b43160d34f233feae20d45209c6f759c14482b58b
Loki
c7d61fee58d6bb0e581f517fff6ab3c3738fbb12a261e3ce10c525d18fc1c1a9
Loki
da26ba1e13ce4702bd5154789ce1a699ba206c12021d9823380febd795f5b002
Loki
e9fc4844ee50f9e59616bd7238bfae3de6b8b194abf635e787e5a44d8658fe42
Loki
fa02a7e8922b8a0a152ff8ced55d3b005e6eac67af9d9eff7ec03192b6d1aee3
Loki
+ 2'062 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::CopySid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::GetLengthSid
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::GetAce
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CoCreateInstanceEx
ole32.dll::CoInitializeSecurity
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mciSendStringW
WINMM.dll::timeGetTime
WINMM.dll::waveOutSetVolume
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAce
ADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetAclInformation
ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserW
KERNEL32.dll::CreateProcessW
ADVAPI32.dll::CreateProcessWithLogonW
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::SetSystemPowerState
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
IPHLPAPI.DLL::IcmpCreateFile
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LogonUserW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetAddConnection2W
MPR.dll::WNetUseConnectionW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegConnectRegistryW
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::BlockInput
USER32.dll::CloseDesktop
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::FindWindowW

Comments