MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 724f5d4672837cfb5fda58bf5ec117b177c17486ed9c4bf2fd8325dc836bb0da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 724f5d4672837cfb5fda58bf5ec117b177c17486ed9c4bf2fd8325dc836bb0da
SHA3-384 hash: 7b35e83718e42dbd8f5eea9224a9252f1a31ac8aa55def102d378a661a49b2ea7e0434b04d55c140dbaede7f493eaaac
SHA1 hash: 5f68c12fdd041e31a83e180e236e5ae29a533bfc
MD5 hash: a9432cff64dbdee66da37dfdbe50a95e
humanhash: friend-hawaii-mirror-angel
File name:Augustin Order List.exe
Download: download sample
Signature Loki
Create hunting rule
File size:320'000 bytes
First seen:2020-08-14 14:52:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 6144:F19u6kY8JrfxL4XUha0EGbr9G1T1e6STrZOAD:F19u6kY8JxLfEc6SYA
Threatray 1'480 similar samples on MalwareBazaar
TLSH DC64CFA023186B66E53D937DD311184C23F3981FE732DF49BFE703DA5592EA14B62622
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mana.com
Sending IP: 45.127.62.179
From: Eziquiel Augustin<cletus@ojeda.ga>
Reply-To: riswanabdeen.gstic@gmail.com
Subject: FW:Augustin Order
Attachment: Augustin Order List.rar (contains "Augustin Order List.exe")

Loki C2:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/46014/
Detection(s):
SecuriteInfo.com.Generic.mg.a9432cff64dbdee6.2048.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Reading critical registry keys
Creating a file
Changing a file
Replacing files
Creating a file in the %AppData% subdirectories
Deleting a recently created file
Stealing user critical data
Connection attempt to an infection source
Moving of the original file
Sending an HTTP POST request to an infection source
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/430116
Signature
.NET source code contains potential unpacker
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Yara detected AntiVM_3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/724f5d4672837cfb5fda58bf5ec117b177c17486ed9c4bf2fd8325dc836bb0da/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 14:54:10 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ojhv2rtsqn6pwx62lc7v5qixwf34c5eg5woex4x5qms5za3lwdna._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
2920875227a99846d5be677db5ff05a24a88468ad68c35520983465c462353cf
Loki
3d611ca54f64546327d9bc6993662d5058a7f07fa8e16b81fc7ee6ff60d952f2
Loki
4d3e8c6d43fcdf1f060986547c0d0af4a27c4ebe9377b374c6981f27d317d5cf
Loki
5feae79dd60821d07068c2c3d5a9d6051c10064cbcf5d85150753c2e70e9da2a
Loki
722521ac19cd30a318eb191975eecadb389fe26c681d76f1c5da92dc8fabac4f
Loki
b1c1df9daeb93473a208117db8782e0a6245e3b8c6f13da6405a79a1e36ab821
Loki
cd1c77cf56fa182cd0a4ee201381eb27c1c959960ed4eb89501f04ab0c620660
Loki
d2cee19a1e56d95d538becd56933a02727bb4df3e07ed9a476fb5776003361b6
Loki
e53b12eba130b72d981d770ab3f22fd59c3106a7cc01e22efa163c40613d22cf
Loki
f7402454608a5e4510e78a5332f29cbbb01df24be9a879c0c48f27e69a66777d
Loki
+ 1'470 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
spyware trojan stealer family:lokibot
Link:
https://tria.ge/reports/200814-wngp2n7ata/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://195.69.140.147/.op/cr.php/brb4ODSDGUazb
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/724f5d4672837cfb5fda58bf5ec117b177c17486ed9c4bf2fd8325dc836bb0da

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar b6f8cddcf40a1a04c981396a64b31afc2657c7f96f17933c5e5db59ea55dcb63

Loki

Executable exe 724f5d4672837cfb5fda58bf5ec117b177c17486ed9c4bf2fd8325dc836bb0da

(this sample)

  
Dropped by
MD5 e11cc8265bd837dc294c7a9c46f85fbc
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/46014/
  
Dropped by
SHA256 b6f8cddcf40a1a04c981396a64b31afc2657c7f96f17933c5e5db59ea55dcb63

Comments