MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5895fbf523b5bb53bcd3bae2d6ed45f14d184f07e53957138c5aa888a7121010. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5895fbf523b5bb53bcd3bae2d6ed45f14d184f07e53957138c5aa888a7121010
SHA3-384 hash:	f07bfd1386ef2ea0870a8b2f01f7d761ebdb09105d6d9e8d95b17d4133c0f5da68bca681296d6de07f78465c0bab0308
SHA1 hash:	bacec1db2e4b3707def61bcf05ca6c93fbb49d1b
MD5 hash:	597a981958e7c1df48e4ef7a9f105781
humanhash:	rugby-red-maryland-fifteen
File name:	Order Confirmation 004172019Sep order_00417.rar
Download:	download sample
Signature	Loki Alert Create hunting rule
File size:	453'083 bytes
First seen:	2023-09-06 13:18:18 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:QHaQYdpLInmVWpAEPAxaMtboVlBz3sdLRi4PX3:gepopAnZirBAdLA4v
TLSH	T134A42378BBB40E7316D72957F94B367E8481770398E3282E2191F0B84C93C7E6A554B7
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	ozuma5119
Tags:	Loki rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

89

Origin country :

JP

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Order Confirmation 004172019Sep order_00417.exe
File size:	493'568 bytes
SHA256 hash:	446701e7736c00e2c322ca98d6aede83902a30ecbc1499e4910ce5d491f6edf3
MD5 hash:	1d9a54362c5b8745b734539344ac67a6
MIME type:	application/x-dosexec
Signature	Loki

Vendor Threat Intelligence

DocGuard Unknown

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/5895fbf523b5bb53bcd3bae2d6ed45f14d184f07e53957138c5aa888a7121010/results/dashboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade packed

Link:

https://www.filescan.io/uploads/64f87c4667511af1a1b55529/reports/cb6f2667-4c70-4b9f-8ef2-b370a1e766ee/overview

Hybrid Analysis Mal/DrodRar

Verdict:

Malicious

Labled as:

Mal/DrodRar

Link:

https://www.hybrid-analysis.com/sample/5895fbf523b5bb53bcd3bae2d6ed45f14d184f07e53957138c5aa888a7121010

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5895fbf523b5bb53bcd3bae2d6ed45f14d184f07e53957138c5aa888a7121010/

ReversingLabs TitaniumCloud Win32.Trojan.Leonem

Threat name:

Win32.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-09-06 04:47:52 UTC

File Type:

Binary (Archive)

Extracted files:

15

AV detection:

20 of 38 (52.63%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lck7x5jdww5vhpgtxlrnn3kf6fgrqtyh4u4voe4mlkuirjyscaia._file

Hatching Triage lokibot

Result

Malware family:

lokibot

Alert

Create hunting rule

Score:

  10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/230906-rgpf8agb3t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Lokibot

Malware Config

C2 Extraction:

http://chandler.megared.buzz/_errorpages/chandler/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Lokibot

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/5895fbf523b5bb53bcd3bae2d6ed45f14d184f07e53957138c5aa888a7121010