MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ad64a6eaa5d2494a4161158792e7cde3fb7d9a7bd36f06cc0de271192582f439. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Loki
Vendor detections: 4
| SHA256 hash: | ad64a6eaa5d2494a4161158792e7cde3fb7d9a7bd36f06cc0de271192582f439 |
|---|---|
| SHA3-384 hash: | 23dd0bfff9be2c4a0ec6a47596be0669e22da74599f64e683a85cbcd106b852e657a4bc67b35e096609bb9dfa1655720 |
| SHA1 hash: | b7279cbe6ee65e099dd295dff3e2d462d0afdc86 |
| MD5 hash: | 5e30e25782ecca5f036ec2d2736ba9c5 |
| humanhash: | washington-utah-bakerloo-victor |
| File name: | Faktur Bangun Nusa Mandiri.exe |
| Download: | download sample |
| Signature | Loki |
| File size: | 225'280 bytes |
| First seen: | 2020-04-21 12:12:16 UTC |
| Last seen: | 2020-04-21 12:59:01 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | bddeac6a8687f75cb2bb8f2f1d99d3a9 (1 x Loki) |
| ssdeep | 1536:G+yKuU/NZ9hiMKxJRh8lpw+saO8/jeYmYB2roeesBdhGdgbljMkviOvK4uxCANe2:yKuUNZAjulNrt/NMd5XG+akFvKpx |
| Threatray | 2'153 similar samples on MalwareBazaar |
| TLSH | 402406416DB89523C70846316EF6E7B9C3487DD0E9E5CA4F20913B2EAF3378614A652F |
| Reporter |  abuse_ch |
| Tags: | COVID-19 exe Loki |
abuse_ch
COVID-19 themed malspam distributing Loki:HELO: merbabu.indosol.net
Sending IP: 202.51.253.120
From: Unipower <petrusd@datanet.co.id>
Subject: PT.UNIPOWER PRATAMA - INVOICE 098/I/IV/20- PO.9100326941
Attachment: Faktur Bangun Nusa Mandiri.gz (contains "Faktur Bangun Nusa Mandiri.exe")
Loki C2:
http://cmeducationhub.com/wwp/Panel/fre.php
Intelligence
File Origin
# of uploads :
2
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Androm
Status:
Malicious
First seen:
2020-04-21 01:40:24 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
guloader
Similar samples:
+ 2'143 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| VB_API | Legacy Visual Basic API used | MSVBVM60.DLL::__vbaObjSetAddref MSVBVM60.DLL::EVENT_SINK_AddRef |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.