MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85b6b67c3c5ca78f7a51341de9f07a15665e04e0c911a1de0ecfb07d8c873f85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85b6b67c3c5ca78f7a51341de9f07a15665e04e0c911a1de0ecfb07d8c873f85
SHA3-384 hash: abaea6bbfa1ee05756b308eb9d04d2a1174c2300063e1d0970c5dbfa904683b93944949484a1b396266ee99f04be98a2
SHA1 hash: a032fa58799065fe9bcfe99d10c270b134f422f3
MD5 hash: f38ec3dfcd57208e391b89511ca1bc52
humanhash: pluto-lactose-lithium-rugby
File name:f_2020-05-15_06-37.exe
Download: download sample
Signature Loki
Create hunting rule
File size:276'992 bytes
First seen:2020-05-15 17:42:15 UTC
Last seen:2020-05-15 18:33:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 17ea3830e572db020ba385bdc51716d4 (1 x RaccoonStealer, 1 x Loki)
ssdeep 6144:71Q0Fc22KwF37eYntpkMz7WC9At/gMcB:7h62QjnwtiB
Threatray 1'581 similar samples on MalwareBazaar
TLSH D0447D32B3E0AC21F3224A319D2BCAE0653EB9D39D38767B1F547A1F09BD1A18563715
Reporter jarumlus
Tags:Loki

Intelligence

File Origin
# of uploads :
2
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-15 16:03:00 UTC
File Type:
PE (Exe)
Extracted files:
69
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qw3lm7b4lsty66srgqo6t4d2cvtf4bhazei2dxqoz6yh3dehh6cq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
1c207097456316948386b7a46316912bd9107a8039193940be476e07d788ca1d
Loki
2f425f47756ffd6fca6b449b766d0c073ffda51ed9055a91488b9a72bd5f5546
Loki
3082c38383b9b75510e3fa868da957da7dca5ec5f36b97f563280511a9c33916
Loki
6b1765552e8cd27ec550f9c0defdb47919f83df1fc9eafebf8435f91d5e868c9
Loki
890d50ea38e546ea886c5e1d211327e2d4573f3a55f1afc56eacc36ed2187474
Loki
971609985552df81174bf8e23ca9fd7b6feff1f8e86ee5e28b535d955e3358bd
Loki
98a776dc4ed21a6077c36b849adb09ae3731d66c9485279dda469bbcded06aac
Loki
eb6e49cef47c1bd52f218df0e5d132af3aa342ebfcf0b808b5ae90c2bd469401
Loki
ef3a1f525f383f8d5000a9f6fe4337f3c561ad41157d7cbb1bb2905aea18435c
Loki
fe7a6728da6e544a5963774daa1bae063246a1211a815abdb736ea7a31d7bd30
Loki
+ 1'571 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/201109-b3dqeqr8mx/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Lokibot
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Lokibot
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

b50d016508f589ada2d322d5fd832d12f07b6aaa5d079572f502cd0d23898002

Loki

Executable exe 85b6b67c3c5ca78f7a51341de9f07a15665e04e0c911a1de0ecfb07d8c873f85

(this sample)

  
Dropped by
MD5 8f75af0b94ef73b6c099fadceab923e2
  
Dropped by
SHA256 b50d016508f589ada2d322d5fd832d12f07b6aaa5d079572f502cd0d23898002
  
Dropped by
Loki
  
Delivery method
Distributed via e-mail attachment

Comments