MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb6cfee282efc5fa0e2dd8de410f4f7b9e684a3378244948589516d9ffaa81ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb6cfee282efc5fa0e2dd8de410f4f7b9e684a3378244948589516d9ffaa81ad
SHA3-384 hash: 4b85ec04d8ac50904bcf2d3083ee0662a1248581ec92ee47ff69cfd8f2620a07e597488fd166f6532ae6337184852ba1
SHA1 hash: b32ad5acb9e8e71a01d4bf59e88c8164f193d93c
MD5 hash: 96199a3c4b25f340896a6ad773e116aa
humanhash: network-hotel-spring-lithium
File name:infodayclubhai.com__afam.exe
Download: download sample
Signature Loki
Create hunting rule
File size:663'552 bytes
First seen:2020-03-18 18:11:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 25a2ce09eda4fed8677b5f3c54ed0eba (1 x Loki)
ssdeep 12288:PaUAYl+nisUZiXTHq8/Tml7r7Wa34KQsvu:Pa8l+n7UZ0K8/TmZr7Wa34KQsv
Threatray 2'094 similar samples on MalwareBazaar
TLSH 52E41AA0128EA57EDE2705B3F201862782B4EE55E5CCF6F436C9B75717FE3969860202
Reporter ov3rflow1
Tags:exe Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Gamarue-6782456-0
Create hunting rule

Win.Trojan.Gamarue-7088569-0
Create hunting rule

Win.Trojan.Fareit-7101834-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Androm
Create hunting rule
Status:
Malicious
First seen:
2018-04-11 05:24:09 UTC
File Type:
PE (Exe)
Extracted files:
10
AV detection:
29 of 30 (96.67%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
1ef4b0a5bad6d091ba8e79641a6a5893477dd0124d6791f46a65b28b66521d52
Loki
4b914a1d29402382b5e2c4b978092c152679a20023e0ad67d9af6fafa075a862
Loki
5312fab3ad83a00863c90baec3bbe7f1265cc6d94398b364f2cd7c11369af074
Loki
53edc68ef8a890aac3c8f6fe8c72e1a8cf5057c600a3f85d12b99b59b05e47be
Loki
7200e0900aae53fbd40a961458d2fbdf60a715cf4880b9a6397ea007ccf20f17
Loki
7d4f426890be9c55705465a92773cbd44a03d08c110a759d83c32b4a788b8f34
Loki
9bcf29ef3bbb1003db97934e2412dfb77fc1d289797a9b4eab2af243bbc8987f
Loki
d8689dd42505b5642a74074a5b1b37f8cd721c5e6423cf63f1fe80fe180f839a
Loki
e91763b67687e25f299bfd0b9c30863546f6bc3e1d734c382675ce41ad87b2c6
Loki
fe36f8b161c6e9f38fba4be32eb2b67846c9c93de9f48028762f79e5ee2b6169
Loki
+ 2'084 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bb6cfee282efc5fa0e2dd8de410f4f7b9e684a3378244948589516d9ffaa81ad

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Lokibot
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_lokipws_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/4303/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::__vbaSetSystemError
MSVBVM60.DLL::EVENT_SINK_AddRef
MSVBVM60.DLL::__vbaErrorOverflow

Comments