🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e97be24e82801153d94235deb22cd51357b0a14cbfc6ec4bde4bae287b07efb2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e97be24e82801153d94235deb22cd51357b0a14cbfc6ec4bde4bae287b07efb2
SHA3-384 hash: f9db1b7467b5614cb81b3f5c5420e07900ebaad007c08eb57added8b9dd1990996a6d0daa6068d25df299e8442a0479f
SHA1 hash: 5aae6d49dba5bbd3ef0014940f48875556bb321f
MD5 hash: 473e1d83ab0029fa529ed8ab2380c7c8
humanhash: low-cola-steak-delta
File name:Piojdndp.exe
Download: download sample
File size:270'336 bytes
First seen:2022-02-15 09:55:36 UTC
Last seen:2022-02-15 11:47:33 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 62 x CobaltStrike, 44 x JanelaRAT)
ssdeep 6144:J7RnrbnNb3G/geBctpULbs2ULegLizTn3qgStWN:Rxtb2/PBct24eTTs
Threatray 151 similar samples on MalwareBazaar
TLSH T1C344F19E57A48D56D4DD863F50E282508BF5D1038622DB0A1CEC72A2CE7B7A133DF1E9
Reporter proxylife
Tags:dll Lokibot

Intelligence

File Origin
# of uploads :
2
# of downloads :
343
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/241576/
Detection(s):
SecuriteInfo.com.BackDoor.SiggenNET.35.17550.18191.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/620b78b6875593a3cccf3de3/reports/55e7737f-1ada-4cfb-8e49-187d74028f7a/overview
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/291e9c9b-3fa4-47e8-a56b-b1cb37e7a65f
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/939999
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Sigma detected: Suspicious Call by Ordinal
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 572477 Sample: Piojdndp.exe Startdate: 15/02/2022 Architecture: WINDOWS Score: 52 13 .NET source code contains potential unpacker 2->13 15 .NET source code references suspicious native API functions 2->15 17 Sigma detected: Suspicious Call by Ordinal 2->17 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        process5 11 rundll32.exe 9->11         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e97be24e82801153d94235deb22cd51357b0a14cbfc6ec4bde4bae287b07efb2/
Threat name:
ByteCode-MSIL.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2022-02-15 09:56:11 UTC
File Type:
PE (.Net Dll)
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
2af06422e62704ac3eb70a7ce1b5fa08d5a2f0f0bb71b604298aedc24e256f56
35f9dd17bfe8b62676bead6a48638b65fd2372b9699cd7572b58e12192143849
36696f58a4cddf15123f607d294af671ef7d82c5c05339d352b10861ac0df3b7
5dde67093b891df286e998912557fa598ebebc662bb30252fbe9ce7798e50242
829abb88ef2e3a50a7ad30c61a3194f6991a8d6b8db37d29a6f22aad591a4d06
8edf66f1c8c4dc62e3cc1ea37225cd19aeb3597be5f806be5afd55664a3229a5
9767d52eebfbf17f2e549a57d68d7f11c199af327eeb20542b39485f883f61e1
b2c4e34cf9e59885a100b02fc7e808673d1311d86ac1170de009fb607778703b
e3651f5bb9fa7f29846c2c4de863867c46932c88beba48f1bcdb22f54af78545
e5a8176770ea11671eb417ac3f8b999b18b3d2e2be555798729f4742fff52215
+ 141 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  4/10
Tags:
n/a
Link:
https://tria.ge/reports/220215-lyc7maehhl/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious use of AdjustPrivilegeToken
Drops file in Windows directory
Unpacked files
SH256 hash:
e97be24e82801153d94235deb22cd51357b0a14cbfc6ec4bde4bae287b07efb2
MD5 hash:
473e1d83ab0029fa529ed8ab2380c7c8
SHA1 hash:
5aae6d49dba5bbd3ef0014940f48875556bb321f
Link:
https://www.unpac.me/results/68b29216-68be-41ce-b611-b452b53f3426/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e97be24e82801153d94235deb22cd51357b0a14cbfc6ec4bde4bae287b07efb2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/241576/

Comments