MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e3d560223931665e1ace60fb4f095f84525306e399d16c1cca7fa0a7555e7ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 9


Intelligence 9 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e3d560223931665e1ace60fb4f095f84525306e399d16c1cca7fa0a7555e7ea
SHA3-384 hash: 9225436d20fd36eb6dd0ce9593075346427d1217175cd985e9f4603928649ecd1c63024131a81724a24ddddac52b4108
SHA1 hash: 9e078ef7a3b344476a8a48b9047dbb835d7d04cd
MD5 hash: 8944d81da5303b00441ce820e598dfb6
humanhash: shade-mississippi-fourteen-queen
File name:6e3d560223931665e1ace60fb4f095f84525306e399d16c1cca7fa0a7555e7ea
Download: download sample
Signature Loki
Create hunting rule
File size:545'280 bytes
First seen:2020-11-12 13:54:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 632c88703370e9500693e6668445bb2f (3 x Loki)
ssdeep 12288:zBImLfLjdSS/bjbvJZXD7IdFE62/Wq6Z8gFzbiiH:hnvjoPEnURHZ
Threatray 1'937 similar samples on MalwareBazaar
TLSH FFC44A10FA90D035F2BF15BC4EBA5274993A7D707B2584CB52D2BA8A9735AF49C33312
Reporter seifreed
Tags:Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Reading critical registry keys
Changing a file
Replacing files
DNS request
Creating a file in the %AppData% subdirectories
Deleting a recently created file
Stealing user critical data
Connection attempt to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e3d560223931665e1ace60fb4f095f84525306e399d16c1cca7fa0a7555e7ea/
Threat name:
Win32.Trojan.Johnnie
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 13:55:21 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ny6vmardsmlglynm4yh3j4ev7bcskmdohgornqomu75au5kv47va._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
22dcfba741c1520791b89cc96a2b81c32b125d3035c8da71cf956c07aceee138
Loki
2c64af2b995ad6b33bc90f4103e1ae990db77c9c341279c0ab0af1c38d414405
Loki
50718583f71413c3eaeb95f88c1ad4e0b12958758de441ee6a0a20c072a26142
Loki
77777da436f12d38fe7834a137bc2bf51c1f09324a1e274d22e51c2ee0b4b8c3
Loki
7880e819461fdc72eb551b9cdcbd6d0e8417c685d62efb649caca31307009a66
Loki
ceeffdff4b0af45c77f3923e47c03a529c87dd4e0e92fdc88b0551857df53239
Loki
d050b76ba909799dc235b62e32658b86294dbd5c8282df0c4c3f4a5581373603
Loki
d3fe0091ab7aa340ca46bb92d48453fea9a6a9d778ff6d7e8a7a4861850173e7
Loki
e4ae2cb5ba91a9b7a87cb5d79158e07f8252e8c3ad0649fca573a0d73bbbdc62
Loki
f834e2059da963db70d88af267f09807a69fb3edfaefc344e5ab542911835be3
Loki
+ 1'927 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/201112-vssb4kp9w2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Lokibot
Unpacked files
SH256 hash:
6e3d560223931665e1ace60fb4f095f84525306e399d16c1cca7fa0a7555e7ea
MD5 hash:
8944d81da5303b00441ce820e598dfb6
SHA1 hash:
9e078ef7a3b344476a8a48b9047dbb835d7d04cd
Link:
https://www.unpac.me/results/4e9ed5c2-7889-409b-8e7f-b7959d07997d/
SH256 hash:
0f90bd579db24f31ea66c0637fab5d9cee1cced41f60ebbb1ade831a2764e88e
MD5 hash:
9f0db8b47c10aee60c1a0bc2d80fcb3a
SHA1 hash:
c8c9023944c85804e83fb4e40cd9e52ea21e9f6d
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/4e9ed5c2-7889-409b-8e7f-b7959d07997d/
Parent samples :
d3fe0091ab7aa340ca46bb92d48453fea9a6a9d778ff6d7e8a7a4861850173e7
6e3d560223931665e1ace60fb4f095f84525306e399d16c1cca7fa0a7555e7ea
5703a2c4b9de691d7acbb7faa076945e75a0cb39fcf904576ece19e596a2d48c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
XPACK
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6e3d560223931665e1ace60fb4f095f84525306e399d16c1cca7fa0a7555e7ea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:Lokibot
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_lokipws_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments