{"action":"created","issue":{"url":"https://api.github.com/repos/Neo23x0/Loki/issues/8","labels_url":"https://api.github.com/repos/Neo23x0/Loki/issues/8/labels{/name}","comments_url":"https://api.github.com/repos/Neo23x0/Loki/issues/8/comments","events_url":"https://api.github.com/repos/Neo23x0/Loki/issues/8/events","html_url":"https://github.com/Neo23x0/Loki/issues/8","id":76568845,"number":8,"title":"false positives and/or alert questions","user":{"login":"gunnersson","id":9437997,"avatar_url":"https://avatars.githubusercontent.com/u/9437997?v=3","gravatar_id":"","url":"https://api.github.com/users/gunnersson","html_url":"https://github.com/gunnersson","followers_url":"https://api.github.com/users/gunnersson/followers","following_url":"https://api.github.com/users/gunnersson/following{/other_user}","gists_url":"https://api.github.com/users/gunnersson/gists{/gist_id}","starred_url":"https://api.github.com/users/gunnersson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gunnersson/subscriptions","organizations_url":"https://api.github.com/users/gunnersson/orgs","repos_url":"https://api.github.com/users/gunnersson/repos","events_url":"https://api.github.com/users/gunnersson/events{/privacy}","received_events_url":"https://api.github.com/users/gunnersson/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-05-15T02:52:14Z","updated_at":"2015-06-25T07:52:10Z","closed_at":null,"body":"Dear all,\r\n\r\nusing LOKI v0.7 I got:\r\n\r\n1)\r\nMay 14 22:12:54 MR_WHISPER LOKI: File Name IOC matched PATTERN: \\\\windows\\.exe$ DESC: ThreatExpert Statistics MATCH: C:\\Program Files (x86)\\Malwarebytes Anti-Malware\\Chameleon\\Windows\\windows.exe\r\nMay 14 22:12:55 MR_WHISPER LOKI: Yara Rule MATCH: winlogon_ANOMALY FILE: C:\\Program Files (x86)\\Malwarebytes Anti-Malware\\Chameleon\\Windows\\winlogon.exe MD5: 195ed6a960d79116c9b5d8d541946a21 SHA1: 14f3e6b05e5693b1cbd9091bafe2649f830799a3 SHA256: dd4afc38cd49fd8b25d2babb53b5cceada3052fbb9669e146d1500619f50a2d9 MATCHES: \r\n\r\n(Probably) belongs to \r\n<https://www.malwarebytes.org/>\r\n<https://www.malwarebytes.org/antimalware/premium/>\r\n<https://www.malwarebytes.org/chameleon/>\r\n\r\n2.a)\r\nMay 14 23:45:02 MR_WHISPER LOKI: Malware Hash TYPE: SHA1 HASH: a94a8fe5ccb19ba61c4c0873d391e987982fbbd3 FILE: C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\oem139.cat DESC: APTnotes 2014 Miniduke_twitter.pdf\r\n\r\nVT shows <https://www.virustotal.com/de/file/9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08/analysis/>.\r\nFormer versions of LOKI haven't reported this one (as far as I remember...)\r\n\r\n2.b)\r\nMay 14 23:56:41 MR_WHISPER LOKI: Malware Hash TYPE: SHA1 HASH: a94a8fe5ccb19ba61c4c0873d391e987982fbbd3 FILE: C:\\Windows\\System32\\DriverStore\\FileRepository\\nf4sys.inf_amd64_neutral_8582e32df21c4bc2\\nf4sys.cat DESC: APTnotes 2014 Miniduke_twitter.pdf\r\n\r\nVT shows <https://www.virustotal.com/de/file/9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08/analysis/>.\r\nFormer versions of LOKI haven't reported this one (as far as I remember...)\r\n\r\n2.c)\r\n2.a) and 2.b) throw the same SHA256 but are named differently.\r\n\r\n3.)\r\nMay 14 21:34:45 MR_WHISPER LOKI: Error while process memory Yara check (maybe the process doesn't exist anymore or access denied). PID: 1056 NAME: audiodg.exe\r\n\r\nWhat does this mean?\r\n\r\nThank you.\r\n\r\nGunner\r\n"},"comment":{"url":"https://api.github.com/repos/Neo23x0/Loki/issues/comments/115152806","html_url":"https://github.com/Neo23x0/Loki/issues/8#issuecomment-115152806","issue_url":"https://api.github.com/repos/Neo23x0/Loki/issues/8","id":115152806,"user":{"login":"gunnersson","id":9437997,"avatar_url":"https://avatars.githubusercontent.com/u/9437997?v=3","gravatar_id":"","url":"https://api.github.com/users/gunnersson","html_url":"https://github.com/gunnersson","followers_url":"https://api.github.com/users/gunnersson/followers","following_url":"https://api.github.com/users/gunnersson/following{/other_user}","gists_url":"https://api.github.com/users/gunnersson/gists{/gist_id}","starred_url":"https://api.github.com/users/gunnersson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gunnersson/subscriptions","organizations_url":"https://api.github.com/users/gunnersson/orgs","repos_url":"https://api.github.com/users/gunnersson/repos","events_url":"https://api.github.com/users/gunnersson/events{/privacy}","received_events_url":"https://api.github.com/users/gunnersson/received_events","type":"User","site_admin":false},"created_at":"2015-06-25T07:52:10Z","updated_at":"2015-06-25T07:52:10Z","body":"[ALERT] File Name IOC matched PATTERN: [^\\s]\\\\windows\\.exe$ DESC: ThreatExpert Statistics MATCH: C:\\Program Files (x86)\\Malwarebytes Anti-Malware\\Chameleon\\Windows\\windows.exe\r\n\r\nhttps://www.malwarebytes.org/\r\nhttps://www.malwarebytes.org/antimalware/\r\nhttps://www.malwarebytes.org/antimalware/premium/\r\nhttps://www.malwarebytes.org/chameleon/"}}