MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8edf819407d74e9d1e0bbfa4f77d4266f358f67290c28f64295cff2ba74336d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 10


Intelligence 10 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8edf819407d74e9d1e0bbfa4f77d4266f358f67290c28f64295cff2ba74336d5
SHA3-384 hash: 63c0e41efffdf476969167de79487a484cbd073985e8f1a9e4643b1b8d1ba63245541b0b6b8e529be0c0d173a98cbd66
SHA1 hash: c6026a52bd9d9cc43e8a8329c0ad8d27fb85b806
MD5 hash: 784559c7325bfc51b99ef299c4279d10
humanhash: five-nuts-music-oranges
File name:SecuriteInfo.com.NSIS.Injector.0195.tr.9123.24053
Download: download sample
Signature Loki
Create hunting rule
File size:735'688 bytes
First seen:2024-01-16 01:18:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 56a78d55f3f7af51443e58e0ce2fb5f6 (728 x GuLoader, 451 x Formbook, 295 x Loki)
ssdeep 12288:zbSWze9hhCZUIcyR4tBEuemgIkOo7ZjqxE7iMK7x/n5HbbvC1pAFofnA9zEGG9QJ:zbSWshgCIcLVem7kOo7tq4a/n1C1qFoc
TLSH T13DF40246F3604BABE667477008D2637E34B6CE397B13CB1315883A6D6C713F12966972
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter SecuriteInfoCom
Tags:exe Loki signed

Code Signing Certificate

Organisation:Trillebre
Issuer:Trillebre
Algorithm:sha256WithRSAEncryption
Valid from:2023-10-23T03:11:19Z
Valid to:2026-10-22T03:11:19Z
Serial number: 6f0d850b09960b6fd7996746730c538ff19f2aa8
Thumbprint Algorithm:SHA256
Thumbprint: 098f3752ea3fe6dbf1809d76b1788a0719c3b37d5f9d04a3b7bb1a00f7ee19b4
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
406
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/471030/
Detection(s):
SecuriteInfo.com.NSIS.Injector.0195.tr.9123.24053.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control installer lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/65a5d9871bf798554ab27753/reports/90ee3402-ff88-4237-89a1-d25f1118fcfb/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/8edf819407d74e9d1e0bbfa4f77d4266f358f67290c28f64295cff2ba74336d5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/4a256847-2488-4e75-8893-2918c2da1c25
Result
Threat name:
GuLoader, Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1375103
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected GuLoader
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8edf819407d74e9d1e0bbfa4f77d4266f358f67290c28f64295cff2ba74336d5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8edf819407d74e9d1e0bbfa4f77d4266f358f67290c28f64295cff2ba74336d5/
Threat name:
Win32.Trojan.ScarletFlash
Create hunting rule
Status:
Malicious
First seen:
2024-01-16 01:00:54 UTC
File Type:
PE (Exe)
Extracted files:
15
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r3pydfah25hj2hqlx6spo7kcm3zvr5tssdbi6zbjlt7sxj2dg3kq._file
Verdict:
unknown
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:lokibot collection downloader spyware stealer trojan
Link:
https://tria.ge/reports/240116-bph2eaacgl/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Reads user/profile data of web browsers
Guloader,Cloudeye
Lokibot
Unpacked files
SH256 hash:
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 hash:
cff85c549d536f651d4fb8387f1976f2
SHA1 hash:
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
Link:
https://www.unpac.me/results/235cb568-3463-494a-aff1-bfc50d5277f1/
SH256 hash:
8edf819407d74e9d1e0bbfa4f77d4266f358f67290c28f64295cff2ba74336d5
MD5 hash:
784559c7325bfc51b99ef299c4279d10
SHA1 hash:
c6026a52bd9d9cc43e8a8329c0ad8d27fb85b806
Link:
https://www.unpac.me/results/235cb568-3463-494a-aff1-bfc50d5277f1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8edf819407d74e9d1e0bbfa4f77d4266f358f67290c28f64295cff2ba74336d5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:LokiBot
Create hunting rule
Author:kevoreilly
Description:LokiBot Payload
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:Windows_Trojan_Lokibot_0f421617
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

Executable exe 8edf819407d74e9d1e0bbfa4f77d4266f358f67290c28f64295cff2ba74336d5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2748895/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/471030/

Comments