MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f06ce1718cfa4e73366f82c9488b7a4aad4ddede7d7b3b51d44667607a3961c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f06ce1718cfa4e73366f82c9488b7a4aad4ddede7d7b3b51d44667607a3961c
SHA3-384 hash: 89dfd3c770f51aab0eb9154716be958679791db9b4ce9b0291e366b5559851c9056fbf42e7625b370513f8e3b2cae82f
SHA1 hash: 5708ed9bd1a412a40b9abf6178084b69e1b587f5
MD5 hash: f17efee46c4c8369b5bbd1398cc774f1
humanhash: steak-missouri-leopard-island
File name:win32(11).exe
Download: download sample
File size:273'169 bytes
First seen:2020-06-02 08:25:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c2c71dfce9a27650634dc8b1ca03bf0 (160 x Loki, 58 x Formbook, 55 x Adware.Generic)
ssdeep 6144:RPCganNAxAIgiyf69kc7w/AWMWz1YBIX6tsjfg4RTIoi83nB4TGa67B:PanyaIgyk1/GWlOEB0oi83nBcj6d
Threatray 679 similar samples on MalwareBazaar
TLSH B04412193350E857DA9E097204BAE2791AB95CED098B554B1380BE9F7D332C1CF0C6EA
Reporter oppimaniac

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

PUA.Win.Adware.Browserio-6725861-0
Create hunting rule

SecuriteInfo.com.Artemis162931E90DCF.4593.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 08:36:36 UTC
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
0e4c5cf2d1d60e4931c7af6021073006379935d688f5f55ad21fb29844d75a5a
0f24e222f76b19a0f1995c70e3711ab2b1c7e3f41c5e915796e767fce361e2e3
3c81bde8d413cadc04efa32c2754918d4a1a9c43a60181e7907cca8d31107826
3d8cf478e496182ae32a54994a79720e6b5d79e0237e14287290fec3b22fe0bb
581ccb74a37077703bcc314447ce7dfeec42832bad81225f1be6c214ca9bf51d
5c63c2887891a56e0465251c8112ce7a07fc70e782dbc2e80f45f670294d4285
5e23eed104a5bd67c8ae3abe1f3554abac8500bf9f916992df36246b06f14419
7ef7ff0660d406b237fd3253738d60a294c0273ca1436cf9ba87d5b2ea8d62d8
b9d1b551c4bf7bca9c2b2006acaa9b7f4571fa16b469c1bab4d4e260d2a908ad
c2f42cfcfafad77546d57cbfde6a6f4c1c75d684a81304d1ec901285b1873bd3
+ 669 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/201109-elk39j6sfa/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Loads dropped DLL
Blacklisted process makes network request
Lokibot
Malware Config
C2 Extraction:
http://1filesharing.ga/loky4/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 9f06ce1718cfa4e73366f82c9488b7a4aad4ddede7d7b3b51d44667607a3961c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/373100/
  
Delivery method
Distributed via web download

Comments