MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ccb75029aff3e5f012122d38f5a73392301c2ac18b8144da691340f89879b599. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 19

Intelligence 19 IOCs 1 YARA 25 File information Comments

SHA256 hash:	ccb75029aff3e5f012122d38f5a73392301c2ac18b8144da691340f89879b599
SHA3-384 hash:	aae7fac8bbcff9d15e7a2cb2841e0653233ed7b25718032dfdafca873dfa1e73b452089360bf26a768e7fd1587a586a7
SHA1 hash:	55227f97888385067575ad2943b01dd20d0c74f6
MD5 hash:	a7910c4f6acc99745a035e85dd1b065e
humanhash:	football-undress-georgia-avocado
File name:	Credit Note Sept 25.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	1'039'360 bytes
First seen:	2025-09-29 04:00:47 UTC
Last seen:	2025-10-09 15:16:34 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	1895460fffad9475fda0c84755ecfee1 (307 x Formbook, 52 x AgentTesla, 36 x SnakeKeylogger)
ssdeep	24576:J5EmXFtKaL4/oFe5T9yyXYfP1ijXdacDZbVdu:JPVt/LZeJbInQRacDz
Threatray	3'836 similar samples on MalwareBazaar
TLSH	T14525AE027381D062FFAB91734B5AF6115BBC79260123E62F13981DB9BE701B1563E7A3
TrID	40.3% (.EXE) Win64 Executable (generic) (10522/11/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4504/4/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	abuse_ch
Tags:	exe Loki

abuse_ch

Loki C2:
http://94.154.35.238/mich/five/fre.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://94.154.35.238/mich/five/fre.php	https://threatfox.abuse.ch/ioc/1603820/

Intelligence

File Origin

# of uploads :

# of downloads :

327

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Credit Note Sept 25.exe

Verdict:

No threats detected

Analysis date:

2025-09-29 04:02:36 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/efb5efa2-f574-40e0-972f-b16c10d0b8cf

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

LokiBot

Link:

https://www.capesandbox.com/analysis/29343/

Detection(s):

SecuriteInfo.com.Win32.Trojan.Agent.35E5V6.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68da049773afd01b31e0ebaa

Tags:

infosteal autoit emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching a process

Сreating synchronization primitives

Reading critical registry keys

Launching a service

Changing a file

Connecting to a non-recommended domain

Connection attempt

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for recently created files

Sending a custom TCP request

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug autoit compiled-script explorer fingerprint keylogger lokibot lolbin masquerade microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/68da0497674d5fd6aa0f524f/reports/7815bac8-410d-4ec7-8355-85a962cc97e8/overview

Verdict:

Malicious

Labled as:

Trojan.BAT.Agent.gen

Link:

https://www.hybrid-analysis.com/sample/ccb75029aff3e5f012122d38f5a73392301c2ac18b8144da691340f89879b599

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-09-29T00:56:00Z UTC

Last seen:

2025-09-29T00:56:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/ccb75029aff3e5f012122d38f5a73392301c2ac18b8144da691340f89879b599/results?tab=lookup

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a61463bf-17a7-4e31-833b-d72c1bdcd133

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1785647

Signature

Antivirus detection for URL or domain

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Found API chain indicative of sandbox detection

Found malware configuration

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Writes to foreign memory regions

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/ccb75029aff3e5f012122d38f5a73392301c2ac18b8144da691340f89879b599

Verdict:

Malware

YARA:

6 match(es)

Tags:

AutoIt Decompiled Executable PDB Path PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86

Link:

https://app.malva.re/file/a7910c4f6acc99745a035e85dd1b065e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ccb75029aff3e5f012122d38f5a73392301c2ac18b8144da691340f89879b599/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-09-29 04:01:28 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 37 (70.27%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zs3vaknp6ps7aeqsfu4pljztsiybykwbroaujwtjcnaprgdzwwmq._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Loki

605acd8daeed0286629f52eab2267a433f3dfc9f4c3127a94881b96fbf389d97

Loki

6d893d39aa7cbad71156fbede1b15173ea68bcf53cc6aba1d0018270320b56f8

Loki

b0cf41eaffcc2c22c866c4cb721d763021898f74f1bdf35d4ae2711f6edf327b

Loki

d360ff97054b8da398a04cc947ba71f00e6f04ad83163abc9c13a5eaf9d7bd83

Loki

d4fadd4ee8d3864f9a07149decba872260789b39654db894c95ea23e16ede112

Loki

error

Loki

+ 3'826 additional samples on MalwareBazaar

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection discovery spyware stealer trojan

Link:

https://tria.ge/reports/250929-eldt3ael3w/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Lokibot

Lokibot family

Malware Config

C2 Extraction:

http://94.154.35.238/mich/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Verdict:

Malicious

Tags:

lokibot

YARA:

n/a

Link:

https://app.threat.zone/submission/84f754f0-173f-4c73-a9d3-73655f0c4562

Unpacked files

SH256 hash:

ccb75029aff3e5f012122d38f5a73392301c2ac18b8144da691340f89879b599

MD5 hash:

a7910c4f6acc99745a035e85dd1b065e

SHA1 hash:

55227f97888385067575ad2943b01dd20d0c74f6

Link:

https://www.unpac.me/results/1eb554ba-adf9-427e-a053-c321e170bdbc/

SH256 hash:

5d96d811d64f58941e20dffaf6c8b79d0f84a4f9884d2a6e8124009c5dbd2a96

MD5 hash:

443a51f58ab751275e6c4771057fd4c8

SHA1 hash:

3dd583e6bd785da59df8ffa7260735d9169a1130

Detections:

win_lokipws_g0

win_lokipws_auto

lokibot

STEALER_Lokibot

Lokibot

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_GENInfoStealer

Link:

https://www.unpac.me/results/1eb554ba-adf9-427e-a053-c321e170bdbc/

Parent samples :

ccb75029aff3e5f012122d38f5a73392301c2ac18b8144da691340f89879b599
5f6f593e7ab45cfbef33f249eaadc2eb0e29b752a8d517d8793b6dc5f534dce8
e70fdec083ef8fc4fc697f56e1d7e5aea5684083e4123c6df382df80be2c1c45
d4d8f5d50c7945f7c6f6f858014b07f070e32ea872af02b16a3d9597ccd2605f

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ccb75029aff3/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ccb75029aff3e5f012122d38f5a73392301c2ac18b8144da691340f89879b599

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifacts observed in infostealers

Rule name:	infostealer_loki Create hunting rule

Rule name:	infostealer_xor_patterns Create hunting rule
Author:	jeFF0Falltrades
Description:	The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.

Rule name:	Loki Create hunting rule
Author:	kevoreilly
Description:	Loki Payload

Rule name:	LokiBot Create hunting rule
Author:	kevoreilly
Description:	LokiBot Payload

Rule name:	LokiPWS Create hunting rule
Author:	NDA0E
Description:	Detects LokiBot

Rule name:	malware_Lokibot_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	STEALER_Lokibot Create hunting rule
Author:	Marc Rivero \| McAfee ATR Team
Description:	Rule to detect Lokibot stealer

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/

Rule name:	Windows_Trojan_Lokibot_0f421617 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Lokibot_1f885282 Create hunting rule
Author:	Elastic Security

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/29343/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample