MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7896a69d4b9f99ec3ee75220edb376cdbb4905e35a9a4774060054a2827d2978. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7896a69d4b9f99ec3ee75220edb376cdbb4905e35a9a4774060054a2827d2978
SHA3-384 hash: 9287342f0aa1a1ae7353984f008e97b0f4291f423dac6abb5c5144b3818ade3cc4f3aeb47f35b2dc5b4c4e1cc880d31d
SHA1 hash: d6e1ded0ac689790e1085e6270b729848888fa43
MD5 hash: ddef5c4ea9cacd5aa39e41f58860d317
humanhash: lactose-foxtrot-uniform-hot
File name:SecuriteInfo.com.Gen.NN.ZevbaF.34122.fm0@aO3mhffi.26768
Download: download sample
Signature Loki
Create hunting rule
File size:90'112 bytes
First seen:2020-05-22 04:05:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 34d84639232bc03a29a814cb63377970 (1 x Loki)
ssdeep 768:mc2UivG8puwk6+J48Xt1ipi26O0oJp2VnrUMI+8KSpkYo1d6:J2UivG8Ee+a89UqUp25DIcPYig
Threatray 251 similar samples on MalwareBazaar
TLSH AC933A167864AC76D8508EF14E16A9E4056FFCA02C494B2F34893F5C7A33F867DA132E
Reporter SecuriteInfoCom
Tags:Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Gen.NN.ZevbaF.34122.fm0@aO3mhffi.26768.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 04:35:24 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 30 (83.33%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
32c2766ee799eeffcfdff37dc5a1237b1c152f36b7108c4bd13c082db2d46423
Loki
3712c1a9e9ab864ee28897d0802179db4a2f664f61629f1154437640be377530
Loki
6972fcf47a2db0c5ce7cd905bd12cbbc5155e98f57e1362a8b1a3c94177a2419
Loki
7b0eeeb2adc3fe44102752fbe9a4ed08b3e3bf07fe633f9c3f4ab67eafb6e0aa
Loki
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
Loki
c523252072f5911950614d6a91d16036b0128c10458f05a4ab0b7a3221780c1a
Loki
d5132d40838a12d557fdcea3492cbe6775330dc7298bb806b076011816fe1f36
Loki
d83429370b6d814b6ff67dd1736424db4e11e39ee745867f09c98f49fae4e1fc
Loki
eecaf5677c5c21d268261eef35a819549dda3c454e9b60e368070aa3bfd2f54c
Loki
f1c0e198445a81a738ad7509079b63752b0bc934cd66ce39bc95cb50224ca0d3
Loki
+ 241 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-e9qbeahrqn/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Lokibot
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

Executable exe 7896a69d4b9f99ec3ee75220edb376cdbb4905e35a9a4774060054a2827d2978

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/366100/
  
Delivery method
Distributed via web download

Comments