MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 968ef8b01986f8990799c72b18684b86919111aac8a03887d0b10f2414023961. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	968ef8b01986f8990799c72b18684b86919111aac8a03887d0b10f2414023961
SHA3-384 hash:	5ed55ac6fc6a112b1e1249ce0a21226c1e6cd3fbf826064a0bb8b3f653da78a3533113bd6bd268e4cd2f5f230f9e4489
SHA1 hash:	eaff8ff6f9de15ebac86f6cc6dc02f0f3d302cb3
MD5 hash:	d25cf5a5007315535117af6ebf5110b0
humanhash:	pennsylvania-south-juliet-alpha
File name:	Swift.gz
Download:	download sample
Signature	Loki Create hunting rule
File size:	145'115 bytes
First seen:	2021-05-20 05:39:11 UTC
Last seen:	2021-05-20 06:06:39 UTC
File type:	zip
MIME type:	application/zip
ssdeep	3072:qCkMkvQ36lXNP83RYbsYON0CPaho1y9QF+uPrp/oH2k2B:uZk3RysYObIU/Prp/gX2B
TLSH	33E312BC72C17EB6038000669A235F13A37FA65BF356E5635D09161E6381BD2EC1F5B8
Reporter	fabjer
Tags:	gz Loki

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

PUA.Win.Trojan.Casino-141

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/968ef8b01986f8990799c72b18684b86919111aac8a03887d0b10f2414023961

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/968ef8b01986f8990799c72b18684b86919111aac8a03887d0b10f2414023961/

Threat name:

Win32.Backdoor.Androm

Status:

Malicious

First seen:

2021-05-19 08:38:08 UTC

AV detection:

10 of 47 (21.28%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s2hprmazq34jsb4zy4vrq2clq2izcenkzcqdrb6qwehsifachfqq._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot spyware stealer trojan

Link:

https://tria.ge/reports/210520-93dewcs5qx/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Loads dropped DLL

Lokibot

Malware Config

C2 Extraction:

http://gimpex-imreys.com/Bn2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/968ef8b01986f8990799c72b18684b86919111aac8a03887d0b10f2414023961