MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92099ae4ebedf7dfa426a94b06ce69f98713de3154e71e975208a3e6985493c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92099ae4ebedf7dfa426a94b06ce69f98713de3154e71e975208a3e6985493c8
SHA3-384 hash: 337b3a423ad7d72762e82d2ed5eda263b3ec789f5c62480646a6403057b34ec87361b440e2017d7d520894a62e8b0943
SHA1 hash: 355cac714ba0f990748f3cace1eda38499207694
MD5 hash: 6345b02c498c2b60b418d12b2784f439
humanhash: snake-east-failed-mexico
File name:Reciept NoG11057 -Scanned-pdf.exe
Download: download sample
Signature Loki
Create hunting rule
File size:421'376 bytes
First seen:2020-06-16 08:26:23 UTC
Last seen:2020-06-16 09:27:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 897c607b075e0eacee5d7c72d782f2db (1 x Loki)
ssdeep 12288:x8x5yJuftHYQGr69R7MYRIhY43FHF+Iw1dZ:x8DyJu1Hw6Ve
Threatray 1'653 similar samples on MalwareBazaar
TLSH 629412C6C7150276D52D9437550B0D2AA378FC6E382F8FB356109D8EF5BA8EBBC00296
Reporter jarumlus

Intelligence

File Origin
# of uploads :
2
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/10653/
Detection(s):
PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Adware.Generic4.BBFB.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 08:28:05 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=siezvzhl5x357jbgvffqnttj7gdrhxrrkttr5f2sbcr6ngcuspea._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
07edd07b95ce139ce4d69b7b1c18622f776d3facb705a31b11e60bc4ed44b47b
Loki
13b8c5ee8e938377dec54d8026e8545e0ce5e1d6a3c80b8ae82ea4840a949e34
Loki
2809f01ba48f98c74a1c1f5b7e35c6738dbbea563be128e1273e424bae28106d
Loki
2dd2cafba54d0f7610c085a225debb2297cbe70d95b65833f85a0d62cfda6a87
Loki
5b2989ef162f3637ce93f1aa6b8a0efaf712078d1217aed9150b8c7dc55f0275
Loki
895567da41f2c95706fe5037f680b74af1d33ea6e9901cfbf376f69a35e7a8fd
Loki
90f0395e41f479e98d9ab159b7920dfbd83e1111106b852c903494c0bcd9e9af
Loki
a212bc09d6a1698184ee6c7982583a26b9f15df86081dd578163869a54934e8d
Loki
d6669b8b2c96b8a6991ca1d7f0c1094356cf0263ee458c7c88d94e8188d32184
Loki
de1a51137a4a9259726fd5887b65c912d86831e0067bfdda7350c6379720fc63
Loki
+ 1'643 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
spyware trojan stealer family:lokibot
Link:
https://tria.ge/reports/200624-gs46x6tfgs/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: RenamesItself
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://apoxnew.com/36k/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

648a659c046e234772eaed41a53cc32594029fe3c348469cd99d6d2787931a3e

Loki

Executable exe 92099ae4ebedf7dfa426a94b06ce69f98713de3154e71e975208a3e6985493c8

(this sample)

  
Dropped by
MD5 7c5e07fe27e13f7fcfec4d0acd021f80
  
Dropped by
SHA256 648a659c046e234772eaed41a53cc32594029fe3c348469cd99d6d2787931a3e
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/10653/

Comments