MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb90ff94822154b2ec1bc9e9fd11bd64bcb77c84896bc01e3952e44f45ec75e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 19


Intelligence 19 IOCs 1 YARA 27 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb90ff94822154b2ec1bc9e9fd11bd64bcb77c84896bc01e3952e44f45ec75e3
SHA3-384 hash: 9dca24468e04362e954aa6c941edf820f346184d5bbe7108a7739799dbdf97925051b1f93d99e1361fed5541ce1b71b5
SHA1 hash: 6c808f87e29cd0104b122ceb24739d670423d120
MD5 hash: 341ce29c7a2e57fab43ad642578cbc6a
humanhash: lake-twelve-south-zulu
File name:341ce29c7a2e57fab43ad642578cbc6a.exe
Download: download sample
Signature Loki
Create hunting rule
File size:1'273'856 bytes
First seen:2025-09-12 20:35:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 356f908c1b0cd139f4a1e44528f97d0c (4 x Loki)
ssdeep 24576:gReuectp9dCDX0wtJ+VHo2qFSasuIGD/zOX6WXaaKjhZZSY:g7CT3aRgSaJIIM6WUjhZZj
TLSH T118459E13B7C3C1A6DFA20AB2D47543371E7ABCA0173C99CB6641342EE871ED06A75B58
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon ccdaece2fae4b2b0 (4 x Loki)
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://pakarabi.net/loki/Panel/five/fre.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://pakarabi.net/loki/Panel/five/fre.php https://threatfox.abuse.ch/ioc/1588772/

Intelligence

File Origin
# of uploads :
1
# of downloads :
330
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
341ce29c7a2e57fab43ad642578cbc6a.exe
Verdict:
Malicious activity
Analysis date:
2025-09-12 20:38:16 UTC
Tags:
lokibot stealer auto-sch-xml trojan
Link:
https://app.any.run/tasks/f3ef4e5f-5fc0-418d-a261-18821ff13c6f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/27250/
Detection(s):
Win.Dropper.ImminentMonitorRAT-9965568-0
Create hunting rule

Win.Dropper.ImminentMonitorRAT-9965570-0
Create hunting rule

Win.Packed.ImminentMonitorRAT-9965578-0
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68c4842ad49ea3f1e4b4ce60
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Moving a recently created file
Creating a process from a recently created file
Launching a process
Searching for synchronization primitives
Сreating synchronization primitives
Sending a custom TCP request
Unauthorized injection to a recently created process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug base64 fingerprint keylogger lolbin microsoft_visual_cc reconnaissance schtasks
Link:
https://www.filescan.io/uploads/68c48421dbc6f5a29c42a007/reports/06b613ae-9d4f-42de-87d6-fb96fae328dc/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/cb90ff94822154b2ec1bc9e9fd11bd64bcb77c84896bc01e3952e44f45ec75e3
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-11T12:16:00Z UTC
Last seen:
2025-09-11T12:16:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/cb90ff94822154b2ec1bc9e9fd11bd64bcb77c84896bc01e3952e44f45ec75e3/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/8ba15314-335e-47b9-b8fa-db7abf637b09
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1776758
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample or dropped binary is a compiled AutoHotkey binary
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1776758 Sample: oDjY3HIl04.exe Startdate: 12/09/2025 Architecture: WINDOWS Score: 100 44 pakarabi.net 2->44 48 Suricata IDS alerts for network traffic 2->48 50 Found malware configuration 2->50 52 Malicious sample detected (through community Yara rule) 2->52 54 10 other signatures 2->54 9 oDjY3HIl04.exe 5 2->9         started        13 Svchostt.exe 2 2->13         started        signatures3 process4 file5 36 C:\Users\user\AppData\...\Svchostt.exe (copy), PE32 9->36 dropped 38 C:\Users\user\AppData\Local\Svchostt-t.exe, PE32 9->38 dropped 40 C:\Users\user\AppData\Local\Svchost.Text, PE32 9->40 dropped 42 C:\Users\user\AppData\Local\MCconfig.dll, PE32 9->42 dropped 64 Contains functionality to register a low level keyboard hook 9->64 66 Sample or dropped binary is a compiled AutoHotkey binary 9->66 15 Svchostt.exe 3 9->15         started        18 Svchostt-t.exe 5 9->18         started        68 Injects a PE file into a foreign processes 13->68 21 Svchostt.exe 13->21         started        signatures6 process7 file8 70 Tries to steal Mail credentials (via file registry) 15->70 72 Injects a PE file into a foreign processes 15->72 23 Svchostt.exe 59 15->23         started        32 C:\Users\user\AppData\Local\x, XML 18->32 dropped 74 Antivirus detection for dropped file 18->74 76 Multi AV Scanner detection for dropped file 18->76 78 Uses schtasks.exe or at.exe to add and modify task schedules 18->78 28 schtasks.exe 1 18->28         started        signatures9 process10 dnsIp11 46 pakarabi.net 54.146.6.253, 49717, 49720, 49722 AMAZON-AESUS United States 23->46 34 C:\Users\user\AppData\...\31437F.exe (copy), PE32 23->34 dropped 56 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 23->56 58 Tries to steal Mail credentials (via file / registry access) 23->58 60 Tries to harvest and steal ftp login credentials 23->60 62 Tries to harvest and steal browser information (history, passwords, etc) 23->62 30 conhost.exe 28->30         started        file12 signatures13 process14
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cb90ff94822154b2ec1bc9e9fd11bd64bcb77c84896bc01e3952e44f45ec75e3
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.00 SOS: 0.23 SOS: 0.25 Win 32 Exe x86
Link:
https://app.malva.re/file/341ce29c7a2e57fab43ad642578cbc6a
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/cb90ff94822154b2ec1bc9e9fd11bd64bcb77c84896bc01e3952e44f45ec75e3/
Threat name:
Win32.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-09-10 06:07:54 UTC
AV detection:
23 of 38 (60.53%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zoip7fecefklf3a3zhu72en5ms6lo7eerfv4ahrzklse6rpmoxrq._file
Verdict:
malicious
Label(s):
admintool_autohotkey
Create hunting rule
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
error
Loki
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection discovery execution persistence spyware stealer trojan
Link:
https://tria.ge/reports/250912-zddjjsep5z/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Lokibot
Lokibot family
Malware Config
C2 Extraction:
http://pakarabi.net/loki/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Verdict:
Malicious
Tags:
Win.Dropper.ImminentMonitorRAT-9965568-0
YARA:
n/a
Link:
https://app.threat.zone/submission/6880cb11-81d2-4dd6-a4ef-0c17370d5bde
Unpacked files
SH256 hash:
cb90ff94822154b2ec1bc9e9fd11bd64bcb77c84896bc01e3952e44f45ec75e3
MD5 hash:
341ce29c7a2e57fab43ad642578cbc6a
SHA1 hash:
6c808f87e29cd0104b122ceb24739d670423d120
Link:
https://www.unpac.me/results/7b43c59b-25b3-445a-8c6c-65dec322b6ab/
SH256 hash:
552fd2d5ed44515506c0ab87da49a65d6c2c301bd40911ebbf0456a1804bb34c
MD5 hash:
c4d243e47796fdc9feab34f4cf29e800
SHA1 hash:
3070ea2bb07abba4c053154f63410af267c9473a
Link:
https://www.unpac.me/results/7b43c59b-25b3-445a-8c6c-65dec322b6ab/
SH256 hash:
6d3c2217b8d283fa208b146e1642fc51eccac9c56dc1792a08e58701fef8c442
MD5 hash:
cc825d825390e09f0c21dcdea486ab81
SHA1 hash:
18cd9c68d4a14f7da3a1ad07f6843603dde40c9f
Link:
https://www.unpac.me/results/7b43c59b-25b3-445a-8c6c-65dec322b6ab/
SH256 hash:
bbee34359e7e473e25a1962b9a345e7e68893369f2271b6adcd6ea4811bec9a1
MD5 hash:
a792765c889fe968823e16946e2a361d
SHA1 hash:
3d33a579a17fb9d0d23b292dfe9d6639d37b6dc7
Link:
https://www.unpac.me/results/7b43c59b-25b3-445a-8c6c-65dec322b6ab/
SH256 hash:
f99710ff79652237bb2bb8846f64791a1f099ce6b2b7a87f6632f638752c893b
MD5 hash:
ca8f3dbd9c5af06b5d417dc14c0a3a49
SHA1 hash:
6635fab748796c3bdcf362d2201c40126d4b17dc
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
lokibot
Create hunting rule
STEALER_Lokibot
Create hunting rule
SUSP_XORed_URL_In_EXE
Create hunting rule
Lokibot
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Link:
https://www.unpac.me/results/7b43c59b-25b3-445a-8c6c-65dec322b6ab/
Parent samples :
cb90ff94822154b2ec1bc9e9fd11bd64bcb77c84896bc01e3952e44f45ec75e3
1bc87c4f205cd112b2cec3f67c577ae7b604ed56c6cd6a15d8ad1ae6438598b8
b812cdb8e88e818a206ac067adbc9017ea3dcedb19544493858247a0cfa591dc
dc09d93c6815646ab07908d02c810efd668179f2fb43237c588657171f06a762
SH256 hash:
e5936d703244284a84aaa908a68bf9fdf322d754cb4522c6956d45b19bf1f2a9
MD5 hash:
ba4d3a01b8dd96db39ec4ecb683b4bdc
SHA1 hash:
fa16213e286299493093d1be0daf26f5e2f1809a
Link:
https://www.unpac.me/results/7b43c59b-25b3-445a-8c6c-65dec322b6ab/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cb90ff948221/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cb90ff94822154b2ec1bc9e9fd11bd64bcb77c84896bc01e3952e44f45ec75e3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifacts observed in infostealers
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:LokiBot
Create hunting rule
Author:kevoreilly
Description:LokiBot Payload
Rule name:LokiPWS
Create hunting rule
Author:NDA0E
Description:Detects LokiBot
Rule name:malware_Lokibot_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Trojan_Lokibot_0f421617
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Lokibot_1f885282
Create hunting rule
Author:Elastic Security
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/27250/

Comments