MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a95d59abae2a8542c3794527f2ded1b421d56a1506a08ba5e27881fe0684d20. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 10


Intelligence 10 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a95d59abae2a8542c3794527f2ded1b421d56a1506a08ba5e27881fe0684d20
SHA3-384 hash: f5514488a44dfc7a2797c1efdfd01181ea9813778517acbe142ad3081a217adbbcf7c3fb38c0feb2144c8c3e30bfe16a
SHA1 hash: 68b755c850201ea58180a9e8da175aff407b5641
MD5 hash: 1fae291d732535c20b21afa9cd14def8
humanhash: ceiling-lima-cardinal-asparagus
File name:1FAE291D732535C20B21AFA9CD14DEF8.exe
Download: download sample
Signature Loki
Create hunting rule
File size:1'241'656 bytes
First seen:2021-04-03 21:20:12 UTC
Last seen:2021-04-03 21:48:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 023e80aceb58777f851d3990e08bced3 (2 x Loki)
ssdeep 6144:yugiI1i1nhAs17AYN2VHiT49V7lfoHO7joXVSQtcoXVSQtMPiwSQpoX5:yHNgJUIsiTEPoPVSQtjVSQtMawSQe5
Threatray 700 similar samples on MalwareBazaar
TLSH 8A45C033BEF8FF78CD1C5930E4AD8985581079C83A4CCE4FB1549E978C71266B5A868B
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://wadihaveli.com/js/js/Panel/five/fre.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://wadihaveli.com/js/js/Panel/five/fre.php https://threatfox.abuse.ch/ioc/6686/

Intelligence

File Origin
# of uploads :
2
# of downloads :
285
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1FAE291D732535C20B21AFA9CD14DEF8.exe
Verdict:
No threats detected
Analysis date:
2021-04-03 21:24:23 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5d1171ef-5528-4b50-abd9-269fe7190ad0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/132035/
Detection(s):
SecuriteInfo.com.Heur.PonyStealer.ln1@hurYCEci.382.6556.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/03b9c23e-2a54-4fa1-b0c6-32c5f76fd672
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/665323
Signature
Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Generic Dropper
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5a95d59abae2a8542c3794527f2ded1b421d56a1506a08ba5e27881fe0684d20/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-31 07:51:59 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lkk5lgv24kufilbxsrjh6lpndnbb2vvbkbvaros6e6eb7ydijuqa._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
479f929625a3e8a8f98256c3a020f5946e0d88fd7e3582e47b63500679d46585
Loki
5c2766a9b8df935b6144459c3ae5c8f6b7cab54ab844cc78ae770ed1481c4220
Loki
6e6fa2f1d1b7e3c37b6c7a18a4bd750e6ca980741c87af931c17d2ed7e469c3e
Loki
7765b39aa0345fd2af3838a548807c90094ea98d227d625ed742260833643b52
Loki
8f71fca5621ccb7ba3558cfebc17014d27923d1c73ad97ececb577fd5b937047
Loki
93ff33867e6593f0e5a80ba261665c6f162bceed6cb39362811a70aa6561cf11
Loki
9433390a8374d47e62017b03c8d949af363e1f1aaa5247a2e320fc611c42f138
Loki
b0ce84526989dd02968e8ddae780d47de367ece10dbfc9d472893531abd08825
Loki
deb7f6e76d0d27a58d7eb53380b8f399d81caa842fe188830327b9aad82afdb0
Loki
f8c32c700279f87b3956631cc6567e746afed535006a45f0839d4d346db8ad00
Loki
+ 690 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210403-yl8nh5plfe/
Behaviour
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
1ab1eb8fd78e0d0c7a321fb59d2c27bfb8c9b4cbfc29e415284c48b7ccaded66
MD5 hash:
f68221bf54ff2fd0a1e6dc042cece563
SHA1 hash:
eee21c9c272a7244506d0b8ece7222910916d396
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/459d0466-bce0-46a2-8106-5eebd1809cf7/
SH256 hash:
5a95d59abae2a8542c3794527f2ded1b421d56a1506a08ba5e27881fe0684d20
MD5 hash:
1fae291d732535c20b21afa9cd14def8
SHA1 hash:
68b755c850201ea58180a9e8da175aff407b5641
Link:
https://www.unpac.me/results/459d0466-bce0-46a2-8106-5eebd1809cf7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Gamarue
Score:
0.70
Link:
https://yomi.yoroi.company/submissions/5a95d59abae2a8542c3794527f2ded1b421d56a1506a08ba5e27881fe0684d20

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/132035/

Comments