YARAify Scan Results

Task Information

---

Task ID:	4132e9be-cc7f-11f0-a73e-42010aa4000b
File name:	4ee6e662d89e56f381a546f3bc671658
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

---

The file matched the following open source and commercial ClamAV rules.

Signature:	Win.Trojan.Autoit-7057866-1 Alert Create hunting rule

Signature:	Win.Trojan.naKocTb-6331389-1 Alert Create hunting rule

YARA Results

---

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	DebuggerCheck__QueryInfo Alert Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DetectEncryptedVariants Alert Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	HeavensGate Alert Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Alert Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Alert Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Alert Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifacts observed in infostealers
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	infostealer_loki Alert Create hunting rule
TLP:	TLP:WHITE
Repository:	jeFF0Falltrades

Rule name:	infostealer_xor_patterns Alert Create hunting rule
Author:	jeFF0Falltrades
Description:	The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
TLP:	TLP:WHITE
Repository:	jeFF0Falltrades

Rule name:	Loki Alert Create hunting rule
Author:	kevoreilly
Description:	Loki Payload
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	Lokibot Alert Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	LokiBot Alert Create hunting rule
Author:	kevoreilly
Description:	LokiBot Payload
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	LokiPWS Alert Create hunting rule
Author:	NDA0E
Description:	Detects LokiBot
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	malware_Lokibot_strings Alert Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	NET Alert Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	RANSOMWARE Alert Create hunting rule
Author:	ToroGuitar
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	STEALER_Lokibot Alert Create hunting rule
Author:	Marc Rivero | McAfee ATR Team
Description:	Rule to detect Lokibot stealer
TLP:	TLP:WHITE
Repository:	advanced-threat-research

Rule name:	win_lokipws_auto Alert Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.lokipws.
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	classified
Author:	classified
TLP :	TLP:GREEN

Rule name:	Windows_Trojan_Lokibot_0f421617 Alert Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Lokibot_1f885282 Alert Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

---

The following files could be unpacked from this sample.