MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 471745261953e9374e2ce9e42fc725ac1f59add047252e377aed07bbb6fd36a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 21

Intelligence 21 IOCs YARA 24 File information Comments

SHA256 hash:	471745261953e9374e2ce9e42fc725ac1f59add047252e377aed07bbb6fd36a6
SHA3-384 hash:	236b3b5555c65065e4150b3fc709e56b41f350fe001372dba48afcafcc7fa46c293b6cbd4bfb32b1930a6091ceed79cd
SHA1 hash:	f9486aabf43ad7e36c7f6fb9412404047dc5da68
MD5 hash:	d5661a66d0decc4dd5ab7a2e3fc4f25e
humanhash:	oregon-autumn-equal-virginia
File name:	LKJ876543456780009800000.scr
Download:	download sample
Signature	Loki Create hunting rule
File size:	517'120 bytes
First seen:	2025-12-01 15:14:04 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	21371b611d91188d602926b15db6bd48 (70 x Formbook, 33 x AgentTesla, 20 x RemcosRAT)
ssdeep	12288:1z7hU5I5yuNHIgzSFKxWltRohBfSTso93U0fIB0CQp1RI:1f+iN57Gtene3Ffm0Ci1RI
Threatray	4'058 similar samples on MalwareBazaar
TLSH	T15EB4129269C0AA94C26473308436CC6185787970DE06766E876DF66B7C703D3FEA7B0E
TrID	39.1% (.EXE) UPX compressed Win32 Executable (27066/9/6) 38.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 7.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.9% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	threatcat_ch
Tags:	exe Loki UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	517'120 bytes
File size (de-compressed) :	1'023'488 bytes
Format:	win32/pe
Unpacked file:	87074659e5cfae42bb2b9e475b95d9c5d729d298ac80be029f3453b853aa0cc2

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

AutoIt PEPacker

Details

AutoIt

extracted scripts and files

PEPacker

a UPX version number and an unpacked binary

Link:

https://research.acce.ciphertechsolutions.com/results/6cbd9325-c6eb-4680-8bcc-fba80e8cc795/

Malware family:

n/a

ID:

File name:

LKJ876543456780009800000.scr

Verdict:

Malicious activity

Analysis date:

2025-12-01 15:16:10 UTC

Tags:

auto-startup

Link:

https://app.any.run/tasks/376da41c-8c6c-4222-b61b-58bd073fadae

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

LokiBot

Link:

https://www.capesandbox.com/analysis/42033/

Verdict:

Clean

Score:

N/A%

Link:

https://cyber-fortress.com/docs/result/index.php?id=692db0cbc908fdc697475e59

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Creating a file

Creating a process from a recently created file

Launching a process

Сreating synchronization primitives

Reading critical registry keys

Launching a service

Changing a file

Connection attempt

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

DNS request

Enabling the 'hidden' option for recently created files

Stealing user critical data

Enabling autorun by creating a file

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

autoit compiled-script masquerade microsoft_visual_cc overlay packed packed packed upx

Link:

https://www.filescan.io/uploads/692db0c98c699db7f0786477/reports/2dad044a-29c6-49a8-8df1-8797c61ae76c/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/471745261953e9374e2ce9e42fc725ac1f59add047252e377aed07bbb6fd36a6

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-12-01T09:18:00Z UTC

Last seen:

2025-12-03T12:57:00Z UTC

Hits:

~1000

Detections:

Trojan.Win32.Agent.sb Backdoor.Androm.HTTP.Notification Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Fareit.sb Trojan.Win32.Gorgon.sb Trojan-Dropper.Win32.Dorifel.sbd Backdoor.Win32.Androm.vyyy Backdoor.Androm.HTTP.C&C Trojan.Win32.Auzenpak.sb Trojan.CMY3U.TCP.C&C Trojan.Win32.Strab.sb Trojan.Win32.Inject.sb VHO:Backdoor.Win32.Androm.vyza PDM:Trojan.Win32.Generic Backdoor.Androm.TCP.C&C Backdoor.Androm.HTTP.ServerRequest Trojan.Win32.Zenpak.sb

Link:

https://opentip.kaspersky.com/471745261953e9374e2ce9e42fc725ac1f59add047252e377aed07bbb6fd36a6/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a8f4df1e-7607-4023-9f83-50700770c582

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1823653

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Drops VBS files to the startup folder

Found API chain indicative of sandbox detection

Found malware configuration

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/471745261953e9374e2ce9e42fc725ac1f59add047252e377aed07bbb6fd36a6

Verdict:

Malware

YARA:

5 match(es)

Tags:

AutoIt Decompiled Executable PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86

Link:

https://app.malva.re/file/d5661a66d0decc4dd5ab7a2e3fc4f25e

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/471745261953e9374e2ce9e42fc725ac1f59add047252e377aed07bbb6fd36a6/

Verdict:

Malicious

Threat:

Family.LOKIBOT

Link:

https://tip.neiki.dev/file/471745261953e9374e2ce9e42fc725ac1f59add047252e377aed07bbb6fd36a6

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-12-01 12:32:59 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 38 (68.42%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=i4lukjqzkputotrm5hsc7rzfvqpvtloqi4ss4n325ud3xnx5g2ta._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Loki

60ca1d32e2a19f4df9278382f81b3b460181dab8060b9ee2922ce9c497fb181d

Loki

87074659e5cfae42bb2b9e475b95d9c5d729d298ac80be029f3453b853aa0cc2

Loki

b39df39579ecb80331677bf1a9c36a857fc48f8658839987af4493ff4e73efa9

Loki

ccb75029aff3e5f012122d38f5a73392301c2ac18b8144da691340f89879b599

Loki

error

Loki

+ 4'048 additional samples on MalwareBazaar

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection discovery spyware stealer trojan upx

Link:

https://tria.ge/reports/251201-smflyaa19a/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Program crash

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

Accesses Microsoft Outlook profiles

Drops startup file

Executes dropped EXE

Lokibot

Lokibot family

Malware Config

C2 Extraction:

http://198.23.177.219/siu/pin.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Verdict:

Malicious

Tags:

lokibot

YARA:

n/a

Link:

https://app.threat.zone/submission/96239fb5-3b6a-4ee6-b8ee-c12d8567ede0

Unpacked files

SH256 hash:

471745261953e9374e2ce9e42fc725ac1f59add047252e377aed07bbb6fd36a6

MD5 hash:

d5661a66d0decc4dd5ab7a2e3fc4f25e

SHA1 hash:

f9486aabf43ad7e36c7f6fb9412404047dc5da68

Link:

https://www.unpac.me/results/7f18ae05-a10c-4c4f-9912-7d6c4ac5920f/

SH256 hash:

66ac76279add4b34db1e7567b2edca29d83a7c1f15a041b9bafdb58d590cd4fb

MD5 hash:

0e1e27387e63734371165694378214eb

SHA1 hash:

8f26a9b313732e64d826585e08a82d7b7a19afad

Detections:

win_lokipws_g0

win_lokipws_auto

lokibot

STEALER_Lokibot

SUSP_XORed_URL_In_EXE

Lokibot

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_GENInfoStealer

Link:

https://www.unpac.me/results/7f18ae05-a10c-4c4f-9912-7d6c4ac5920f/

Parent samples :

ce8bb22be29d0043943e2a2a0516d6138aae58dafcd9ad76236a4510e693d9f0
471745261953e9374e2ce9e42fc725ac1f59add047252e377aed07bbb6fd36a6
87074659e5cfae42bb2b9e475b95d9c5d729d298ac80be029f3453b853aa0cc2
b89bbec1c1aa51c0cdcafa77da51ed70c0daac03e31d4e06a2659036c5d9f2bf
3972158babfa442f37cb87d065bbaf55d52f063267c95d6c19fc9435f31160de

SH256 hash:

fbffc363d81042b50db66b2eac2dcd4cb310aa5148f22db9654655f315c5e4b9

MD5 hash:

89152aa8f1bf59ecb0fb4734711f4891

SHA1 hash:

d9d1eb7ff8f6ebf04c30c0e81e9304bf99632a05

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/7f18ae05-a10c-4c4f-9912-7d6c4ac5920f/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/471745261953/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/471745261953e9374e2ce9e42fc725ac1f59add047252e377aed07bbb6fd36a6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifacts observed in infostealers

Rule name:	infostealer_loki Create hunting rule

Rule name:	infostealer_xor_patterns Create hunting rule
Author:	jeFF0Falltrades
Description:	The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.

Rule name:	Loki Create hunting rule
Author:	kevoreilly
Description:	Loki Payload

Rule name:	Lokibot Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	LokiPWS Create hunting rule
Author:	NDA0E
Description:	Detects LokiBot

Rule name:	malware_Lokibot_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	STEALER_Lokibot Create hunting rule
Author:	Marc Rivero \| McAfee ATR Team
Description:	Rule to detect Lokibot stealer

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_3 Create hunting rule
Author:	Kevin Falcoz
Description:	UPX 3.X

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

Rule name:	Windows_Trojan_Lokibot_0f421617 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Lokibot_1f885282 Create hunting rule
Author:	Elastic Security

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

exe 471745261953e9374e2ce9e42fc725ac1f59add047252e377aed07bbb6fd36a6

(this sample)

Loki

exe 87074659e5cfae42bb2b9e475b95d9c5d729d298ac80be029f3453b853aa0cc2

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/42033/

Dropping

SHA256 87074659e5cfae42bb2b9e475b95d9c5d729d298ac80be029f3453b853aa0cc2

Dropping

MD5 c83a108ce91ea36043fbd79841c2d6ab

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample