MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46a26fb39083f77a088365eded45839567dd33a1623ddb6440073dbf242c8811. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46a26fb39083f77a088365eded45839567dd33a1623ddb6440073dbf242c8811
SHA3-384 hash: 192256c221cbd04398bf70ed85794fe5c12d4be55cd9c684bb1fb187667750a557906d3d832732f2e50a541017a8f9a9
SHA1 hash: 3b27c60d0508a196d9be62b280b249fa40540838
MD5 hash: 84243049d06d0be786f560fe95392bc2
humanhash: oranges-rugby-six-glucose
File name:Updated Statement.exe
Download: download sample
Signature Loki
Create hunting rule
File size:239'152 bytes
First seen:2021-08-23 07:08:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f86f9a1397ea2f648b8914df9ad78914 (4 x Formbook, 2 x Loki)
ssdeep 6144:vo0Jz1zHG0QaZTbjPczio+TAOsbzRCXdrv0hNNE4:vo0Jpzm05HjPybCXKNW4
Threatray 20 similar samples on MalwareBazaar
TLSH T13F340180B33D96B8F1BC31F54241587656290CB387AF04DBD746B72A6671683D4B23AF
Reporter lowmal3
Tags:exe Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Updated Statement.rar
Verdict:
Malicious activity
Analysis date:
2021-08-19 08:09:21 UTC
Tags:
trojan lokibot stealer
Link:
https://app.any.run/tasks/3b685d2c-8d37-45fc-b37e-89e5812bcf85

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/181406/
Detection(s):
Win.Malware.Malwarex-9887264-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2b997a60-3076-434a-949a-5ae5072b8764
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/837349
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/46a26fb39083f77a088365eded45839567dd33a1623ddb6440073dbf242c8811/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-08-19 07:02:21 UTC
AV detection:
29 of 46 (63.04%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i2rg7m4qqp3xucedmxw62rmdsvt52m5bmi65wzcaa4636jbmraiq._file
Verdict:
unknown
Similar samples:
179d1cf7266d0149e967f7e6829ed485e3bb73e75ffbce4883111f2595845c85
Loki
32ece49c018110f307142a5eff7d169e75731b059fbf81ac26f82aab4111b8c8
Loki
4d86b94057126b61fbccf61d6cdf32593031067a3294c759ece2d282fe4414a0
Loki
a5edaf3e781977e82b6d645cf52e3c8987a69f707f6d6ef2377d9f7546f744e9
Loki
d699748002a4cf4d6250e0aca08e4de6e687f39a9f946171a57f573410be3d25
Loki
e77133630fd1d9de3ee373ff4d04898a2b573ea0160b450b5629db347e41d123
Loki
+ 10 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/210823-z6bj9bptde/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Lokibot
Malware Config
C2 Extraction:
http://everydaywegrind.gq/Office5/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
1e195a1a4cf9c0dcff5bb1ef65a45d869f70b2c3e11e9c0119654d5950ba099c
MD5 hash:
127ada2a40b0268a2bab81f810e9e89f
SHA1 hash:
72f38ec73857301ab37d7c88391cba47a6776212
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/f027eb99-6513-4c65-b5c7-0d3a2b3ececd/
Parent samples :
995bffd2446e01cf7817573adfc1ecf40679b37ffce1640969352ddca313c346
e7ac7c64889312c42876b74c7c4e7be0a383d98449dbc3d41eb9835bea79e0cd
6ad1a9114fabea8c23151bcb789a9867cb2345e7b65187e5443e6f76f20c7037
46a26fb39083f77a088365eded45839567dd33a1623ddb6440073dbf242c8811
54bdd507eb726a7a4ac9f8d7c220e97f447b37c61986e050cf54119ceec42c65
SH256 hash:
46a26fb39083f77a088365eded45839567dd33a1623ddb6440073dbf242c8811
MD5 hash:
84243049d06d0be786f560fe95392bc2
SHA1 hash:
3b27c60d0508a196d9be62b280b249fa40540838
Link:
https://www.unpac.me/results/f027eb99-6513-4c65-b5c7-0d3a2b3ececd/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/46a26fb39083/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/46a26fb39083f77a088365eded45839567dd33a1623ddb6440073dbf242c8811

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

Executable exe 46a26fb39083f77a088365eded45839567dd33a1623ddb6440073dbf242c8811

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/181406/

Comments