MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 070df000e80ccf39e53f4aa7eab00126fee74516937d795f1cef25f6321acc12. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 8

Intelligence 8 IOCs YARA File information Comments

SHA256 hash:	070df000e80ccf39e53f4aa7eab00126fee74516937d795f1cef25f6321acc12
SHA3-384 hash:	eff94c0e2cb39c79dde3fe41a5903698d5c8f9cff3c7633efa073a08cd45150c95cfcd109c8f19432e34d1ca1c563d16
SHA1 hash:	5bb50a5052d457a1707e56c05f5bd48ad41fa099
MD5 hash:	3d971be15fdbf544cc74486f78cf8c07
humanhash:	uranus-florida-mango-summer
File name:	wonjure.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	157'184 bytes
First seen:	2020-07-13 12:52:20 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	3072:qLSXk7/EGQ0+t0/QbMiol3M8CtXWeS6pCtfQZN5zBCFo60b:QQZGsF+3MGRHQvNw+60
Threatray	1'579 similar samples on MalwareBazaar
TLSH	A0E30115A3DF5766DD35AEB03C640332C33BAF044926F6A87B993198CC32F961922772
Reporter	abuse_ch
Tags:	exe geo KOR Loki

abuse_ch

Malspam distributing Loki:

HELO: mail-smail-vm39.hanmail.net
Sending IP: 203.133.180.227
From: 동산상사 <dongsan34@daum.net>
Subject: 발주서송부건
Attachment: file.cab (contains "wonjure.exe")

Loki C2:
http://79.124.8.8/plesk-site-preview/akinsab.ru/http/79.124.8.8/wonjure/Panel/fre.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/25336/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Reading critical registry keys

Launching a service

Creating a file

Changing a file

Replacing files

Connection attempt

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Stealing user critical data

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/070df000e80ccf39e53f4aa7eab00126fee74516937d795f1cef25f6321acc12/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-07-13 12:53:05 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=a4g7aahibthttzj7jkt6vmabe37ooriwsn6xsxy454s7mmq2zqja._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

spyware trojan stealer family:lokibot

Link:

https://tria.ge/reports/200713-a5sqcremjs/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: RenamesItself

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://79.124.8.8/plesk-site-preview/akinsab.ru/http/79.124.8.8/wonjure/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.