LokiBot Packed Binary - Staged Section SHA256 Hashes
This rule detects the presence of known LokiBot packed binaries by matching the SHA256 hashes of staged memory section bins that were recovered during unpacking analysis. This indicates a high-confidence match for known malicious samples associated with the LokiBot information stealer.
YARA
