MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e63c01ac832a15130c1303f995204ddcc0e4bd8e7f78305b407de7a0ad1f2eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 20


Intelligence 20 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e63c01ac832a15130c1303f995204ddcc0e4bd8e7f78305b407de7a0ad1f2eb
SHA3-384 hash: f479b777398d4842ace5add53198ceed37b89a4f4af54243adf74e96067559d0ee5fb663285ccdb707ce9f3427994c7a
SHA1 hash: f0acaf2322a537a03c899ce0d61cad0ba1d373b6
MD5 hash: 7825f8b7ec8952ca7cc4c8c9257e79fe
humanhash: eleven-vermont-sink-stream
File name:March_Purchase_Order.exe
Download: download sample
Signature Loki
Create hunting rule
File size:1'038'848 bytes
First seen:2026-05-20 17:57:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'000 x AgentTesla, 19'906 x Formbook, 12'332 x SnakeKeylogger)
ssdeep 12288:kPRoknCCfOve1NdUaz3UL7tTtCR3X6IZKlcIfWc7sQMLPyp7/:HCT1L9zOIVX6sKuPTs7/
Threatray 207 similar samples on MalwareBazaar
TLSH T12D250610BF5D6215E92D39FD6A66867726322E06A904F5EAE038720DDD31207CF3739E
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 094acb1609217567 (4 x SnakeKeylogger, 3 x AZORult, 1 x MassLogger)
Reporter TomU
Tags:exe Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
51
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
LokiBot RoboSki
Details
LokiBot
C2 url(s) and TDES decryption parameters
RoboSki
a decrypted ReZer0 component and possibly a decryption component
RoboSki
a Base64 + XOR/Sub-decrypted component, its associated key, a mutex, a filename, and ReZer0 configuration parameters including: a load type, a download URL and filename (if configured), an interval (if configured), and varying flags
Link:
https://research.acce.ciphertechsolutions.com/results/af18579b-137a-4d30-831b-08e41028c44a/
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
8c489347ffd25b142c530ecd371a207dc636cd5bf1515f5c0d3cb379455d6758
Verdict:
Malicious activity
Analysis date:
2025-03-06 23:26:50 UTC
Tags:
arch-exec stealer lokibot trojan
Link:
https://app.any.run/tasks/50fc2987-b696-43d2-beb1-6c4aa69eb743

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
LokiBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/66914/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a0df74e4159ce11f601d7b6
Tags:
infosteal spoof
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a file
Searching for synchronization primitives
Reading critical registry keys
Launching a service
Changing a file
Stealing user critical data
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 bitmap lokibot masquerade obfuscated packed packed reconnaissance roboski stego vbnet
Link:
https://www.filescan.io/uploads/6a0dfb7f875badc3b38ebf28/reports/446ea8cc-6c62-4dbc-8bd0-09831da7fe61/overview
Verdict:
Malicious
Labled as:
lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/8e63c01ac832a15130c1303f995204ddcc0e4bd8e7f78305b407de7a0ad1f2eb
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-03-06T08:00:00Z UTC
Last seen:
2026-05-13T09:31:00Z UTC
Hits:
~1000
Detections:
HEUR:Trojan.MSIL.Agent.gen Backdoor.Androm.TCP.C&C Backdoor.Androm.HTTP.C&C Trojan.Win32.Inject.sb Trojan.Win32.Gorgon.sb PDM:Trojan.Win32.Generic Backdoor.Androm.HTTP.ServerRequest Backdoor.Androm.HTTP.Notification Trojan.Win32.Agent.sb Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb HEUR:Trojan.MSIL.Taskun.gen Trojan.CMY3U.TCP.C&C Trojan-PSW.Fareit.HTTP.C&C Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Fareit.sb Trojan.MSIL.Taskun.sb HEUR:Trojan.MSIL.Taskun.sb
Link:
https://opentip.kaspersky.com/8e63c01ac832a15130c1303f995204ddcc0e4bd8e7f78305b407de7a0ad1f2eb/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/1ba1d795-dffe-454d-a48f-eb66c7c515fc
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8e63c01ac832a15130c1303f995204ddcc0e4bd8e7f78305b407de7a0ad1f2eb
Gathering data
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8e63c01ac832a15130c1303f995204ddcc0e4bd8e7f78305b407de7a0ad1f2eb/
Verdict:
Malicious
Threat:
Family.LOKIBOT
Link:
https://tip.neiki.dev/file/8e63c01ac832a15130c1303f995204ddcc0e4bd8e7f78305b407de7a0ad1f2eb
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2025-03-06 11:43:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
38
AV detection:
23 of 36 (63.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rzr4agwigkqvcmgbga7zsuqe3xga4s6y473ygbnua7phucwr6lvq._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
342a7423816355a284fa4e6d361903464361c8e76e87b653705a6797091bab80
Loki
6e3a3e33b2e7792291afadfd45153795c642eecf859eb01911943cd57a55e478
Loki
9e39a3fc8fca2cc19c64e0c75e88f897a7d07f43d3430596fecdccae2b36d680
Loki
c7829cae4b8ccbec8d4bc08d45c44e785b4c006301cbd28c7344d6aeb26b838f
Loki
fc05c8cd30f572b0db13bc5189c99ce499f133f7b65167c06518638c26623a81
Loki
+ 197 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection discovery execution persistence spyware stealer trojan
Link:
https://tria.ge/reports/260520-wkg9jaas7v/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Family: Lokibot
Malware Config
C2 Extraction:
http://94.156.177.41/alpha/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
8e63c01ac832a15130c1303f995204ddcc0e4bd8e7f78305b407de7a0ad1f2eb
MD5 hash:
7825f8b7ec8952ca7cc4c8c9257e79fe
SHA1 hash:
f0acaf2322a537a03c899ce0d61cad0ba1d373b6
Link:
https://www.unpac.me/results/515318d4-aee4-43cb-b8c8-9136eaf0ee21/
SH256 hash:
fe8c46761fb8892d9d322bf065e5162e176012a055e8a48395b1e694b26d4db2
MD5 hash:
002c6de5c8a0edf1e754a57403681984
SHA1 hash:
17b1aa5b9c99743fa682de981bb4fbc2075dc327
Detections:
win_lokipws_auto
Create hunting rule
win_lokipws_g0
Create hunting rule
lokibot
Create hunting rule
Link:
https://www.unpac.me/results/515318d4-aee4-43cb-b8c8-9136eaf0ee21/
Parent samples :
d360ff97054b8da398a04cc947ba71f00e6f04ad83163abc9c13a5eaf9d7bd83
b2b9b4ee2a4edc1926c1bfdfa07061968a2e8f3685f5cae15bfbe4723f9156c9
7e9e014b4127363351ff22d500de90a9872a8d8fcab328277fabd7fc1f4b5c6c
804ca58e99fe47f33eb0ee7db9b0e4794dbe30c165f219bd85884f0f84ac7846
b155dd58a04167ae2b542b3e84c60e2761bd66e7a96f66476d5568b84b801936
b424d963c3385a5a5ab38641ecfb2dc9a660555b137aef15a562375c045da9e9
c49ffc408cbe1ee74d051e6c0ba32bc49f2f16f72e41f008892ffd2a0be87f20
e0d3b77872afeb91741ce976726849d10c33dda1d90edeff99e3090f7b92ed6f
15c29f8660a5dfa2d0033eb7096103fac2027214fbfa426b9b95c8cb4580b5ab
37055616d9baf9634128ef3f41d36ef85f37adb1cfceb1cfc1476fe7bced51d3
8e63c01ac832a15130c1303f995204ddcc0e4bd8e7f78305b407de7a0ad1f2eb
SH256 hash:
3147665c83368cde5138f688416f2c22c35b61ff44607e34e646e2f7af92fe09
MD5 hash:
b947873e4b3d14a22365abf692b07224
SHA1 hash:
34703b174f87ec91b8ccd81329de1141e2731c7e
Link:
https://www.unpac.me/results/515318d4-aee4-43cb-b8c8-9136eaf0ee21/
SH256 hash:
5fdbbb6493691421d515b77e2b93d009efee9bb139244e9d86075b1281f816d3
MD5 hash:
57ab52a70e5141c9ba8b17ae7ea5c0b5
SHA1 hash:
cd8d4a1a3e8ad864559f04aa54c39c09f9565ed9
Link:
https://www.unpac.me/results/515318d4-aee4-43cb-b8c8-9136eaf0ee21/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8e63c01ac832/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8e63c01ac832a15130c1303f995204ddcc0e4bd8e7f78305b407de7a0ad1f2eb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

Executable exe 8e63c01ac832a15130c1303f995204ddcc0e4bd8e7f78305b407de7a0ad1f2eb

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/66914/

Comments