MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee665ac6cacc0fec507227dedc2efaeebddab022b1cf553280a6733e08d7085d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee665ac6cacc0fec507227dedc2efaeebddab022b1cf553280a6733e08d7085d
SHA3-384 hash: 9b9055e705fbb8704a6fa3784a1ec10013512c2558d6bfbe1285b343ac95b34f47036bc77e253590df2b7b5f8481be4d
SHA1 hash: 1e319f4eed8623f93bd1f43826617b84569ca1de
MD5 hash: 2416f32ed0d3111d51fff37f4a2d2702
humanhash: washington-eleven-vermont-triple
File name:ee665ac6cacc0fec507227dedc2efaeebddab022b1cf553280a6733e08d7085d
Download: download sample
Signature Loki
Create hunting rule
File size:622'080 bytes
First seen:2020-03-23 15:58:14 UTC
Last seen:2020-03-23 16:17:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 85f5edf91d2b0cdb95140aa8ebd97bc8 (1 x Loki)
ssdeep 12288:+PQ8rQBmYdGig53OTR5GE7RzTJ1RpJgbAx2+jFG:SQb3rgwPD7RzT3RpJKAU+A
Threatray 1'462 similar samples on MalwareBazaar
TLSH ACD47D23B2A24D77C022563D4C175A68D529BD31AF3D6F861AED7D4CAF3F240392A253
Reporter Marco_Ramilli
Tags:exe Loki

Intelligence

File Origin
# of uploads :
2
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Lptehw-6879858-0
Create hunting rule

Win.Malware.Smdd-6879862-0
Create hunting rule

Win.Malware.Fareit-6879874-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Loki
Create hunting rule
Status:
Malicious
First seen:
2019-03-06 18:28:40 UTC
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
1f1745eb2812b5c0cc6c26b69661ea1d8ab78a541271950e7b97d0cd2b502db1
Loki
2b419f986ea266fa5826fbb6858782f7c2acfda73aa5ec5cb21d64537d6a4ea1
Loki
4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793
Loki
616b49735927d0f2a78649237770fe83d86db4c50731ac38b8395b85a67ac2e2
Loki
90d83343f51a1ec0472c4dfd7c887ee13cf79e060632c45e75cd43ff90450810
Loki
be64654bb507094ad7ace4a1da27dfe42dd6451d9dadb24b8310aa50e8ff5f34
Loki
ceeffdff4b0af45c77f3923e47c03a529c87dd4e0e92fdc88b0551857df53239
Loki
e336780f3321d06dfea57c94467d65e0ab2ab92d77c0267cf17b8d51359a5e38
Loki
e37ecd78243a96e81bf5a9eede3dc6fcef97593211707e5a9175899a16081212
Loki
ffe005fbedb256fd73d88068639c1498dff4349755048184d8aa3cb254ea1e0d
Loki
+ 1'452 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

Executable exe ee665ac6cacc0fec507227dedc2efaeebddab022b1cf553280a6733e08d7085d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/154217/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CreateStreamOnHGlobal
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::FindFirstFileA
kernel32.dll::GetTempPathA
WIN_BASE_USER_APIRetrieves Account Informationkernel32.dll::GetComputerNameA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments