MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aefab120d52de63e24991e9659a4f4a1a71fe9f4f69840a123f67951fb732784. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	aefab120d52de63e24991e9659a4f4a1a71fe9f4f69840a123f67951fb732784
SHA3-384 hash:	18513fe4773567df67360bafeb4dbe0404f5bd9ef1ede61800f55f3e7daa9433f5293a0b43bd520ec6d44e1907588d9d
SHA1 hash:	05462bbae0e3a8dccc5c2ccd430127e49cf88d85
MD5 hash:	16b623dd7b85ae485f977620f73ee94e
humanhash:	uncle-nitrogen-colorado-summer
File name:	16b623dd7b85ae485f977620f73ee94e.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	5'460 bytes
First seen:	2021-12-11 06:54:32 UTC
Last seen:	2021-12-11 08:31:44 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	96:v9t96bEHG5sUROFt8ulUZAtsIUZwRq3OmOTCuos9K9YLj:qxu5j77H
TLSH	T1DCB11100B578F743D12E97BD40C5200967F9222A74A6FB588FD268E327B73E294947D7
Reporter	abuse_ch
Tags:	exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

273

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

16b623dd7b85ae485f977620f73ee94e.exe

Verdict:

No threats detected

Analysis date:

2021-12-11 06:58:13 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/fd071126-b50e-480a-8b3d-63fa4fff3974

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/213287/

Detection(s):

SecuriteInfo.com.Trojan.Siggen16.2685.30615.3798.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

overlay

Link:

https://www.filescan.io/uploads/61b44b4f47ed217c013a53fa/reports/af4a0cc2-a293-4914-a56a-af4990b6c53e/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/2a3cad74-23c5-446c-a478-e1efd5acb922

Result

Threat name:

Unknown

Detection:

unknown

Classification:

n/a

Score:

2 / 100

Link:

https://www.joesandbox.com/analysis/905649

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aefab120d52de63e24991e9659a4f4a1a71fe9f4f69840a123f67951fb732784/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=v35lcigvfxtd4jezd2lftjhuugtr72pu62mebijd6z4vd63te6ca._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/211211-hpsn6scbgp/

Unpacked files

SH256 hash:

aefab120d52de63e24991e9659a4f4a1a71fe9f4f69840a123f67951fb732784

MD5 hash:

16b623dd7b85ae485f977620f73ee94e

SHA1 hash:

05462bbae0e3a8dccc5c2ccd430127e49cf88d85

Link:

https://www.unpac.me/results/9c3f9eaa-0682-4dbf-827f-c0ec2b97938e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/aefab120d52de63e24991e9659a4f4a1a71fe9f4f69840a123f67951fb732784

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time