MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 471ad4b40498feebfe9547fdb57b031b6263b1f7379001e64dcf5da97c9c30a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 471ad4b40498feebfe9547fdb57b031b6263b1f7379001e64dcf5da97c9c30a0
SHA3-384 hash: a0d3a3d2d0c72e410330718e735e7ad159899c877a5641d0f16c98a22293f29341fa54a07f37a1861dbda8b10f39aa17
SHA1 hash: a9981f51f73e7e55f96e6984437b679c92ee9000
MD5 hash: 869b7d7c96b6faa0b41229a540956639
humanhash: purple-april-april-apart
File name:Shipping_Documents.exe
Download: download sample
Signature Loki
Create hunting rule
File size:1'040'632 bytes
First seen:2020-04-30 07:32:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ae2c2a97107d0628c80e1150ce3624cc (2 x Loki)
ssdeep 24576:811111111111111111111111111111111111111111111111111111111111111k:8111111111111111111111111111111k
Threatray 124 similar samples on MalwareBazaar
TLSH B6257C42340CAD01EB6A04B88B19F37791652CE1A866575B398C7B8D3739ED33D7EB24
Reporter jarumlus
Tags:Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Generic-6931747-0
Create hunting rule

Win.Dropper.Razy-6932151-0
Create hunting rule

Win.Dropper.Razy-6932152-0
Create hunting rule

Win.Dropper.Gamarue-6932153-0
Create hunting rule

Win.Dropper.Gamarue-6932260-0
Create hunting rule

Win.Dropper.Gamarue-6932447-0
Create hunting rule

Win.Dropper.Gamarue-6932630-0
Create hunting rule

Win.Dropper.Gamarue-6932705-0
Create hunting rule

Win.Dropper.Gamarue-6932706-0
Create hunting rule

Win.Dropper.Gamarue-6932804-0
Create hunting rule

Win.Dropper.Tkwa-6936327-0
Create hunting rule

Win.Trojan.Razy-6936370-0
Create hunting rule

Win.Trojan.Razy-6936371-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vbinject
Create hunting rule
Status:
Malicious
First seen:
2019-04-04 23:18:00 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
22ee3b9202ff14db33a098ed647d77b626f629d7b823978d19d82f662b73cb03
Loki
45e9959441e6e30c4c7a4dd8b3d56b88ad09d2ad253851ea79be62ec9c1c8f68
Loki
46c1e795439ea1890c5617fb2234cff51ce6785e5b07b2acfc89ddeb86e34a39
Loki
4d9b89978e6ca9cf14cb1f04859e01e66c1e0dbefedd1663617647535c0b3fa0
Loki
5a979bc05628a8a31ba4e8b2a476b2741ff53c278e0b6eb14a179486e26ee8e8
Loki
7ab38a584d867142024cb6ccf1c4b87169eecfa51d8bd7a3fe30d469c15ed98d
Loki
aba097f9d954d01e0e4017809ff7741d5265ac506d7f984020d9474f2b6946cf
Loki
eca9894179ef698c8568b19123c1cea81607e5523804827c91fb12d228faf34a
Loki
eedded196860d1ef5a143268a85bc3951af23e55da8c12b8b1b58b42b9f443f1
Loki
eeec66084fc56b1e253dc3803ee3bf59a71e403a41f55fa6068428e15214ccaa
Loki
+ 114 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Lokibot
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_lokipws_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::__vbaSetSystemError
MSVBVM60.DLL::__vbaObjSetAddref
MSVBVM60.DLL::EVENT_SINK_AddRef
MSVBVM60.DLL::__vbaFileOpen
MSVBVM60.DLL::__vbaErrorOverflow

Comments