MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72df3f9a494ac0d849ea6ba3917dfc37d7275f170f01348d3fd2ad77fb3d601d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 4

Intelligence 4 IOCs YARA 3 File information Comments

SHA256 hash:	72df3f9a494ac0d849ea6ba3917dfc37d7275f170f01348d3fd2ad77fb3d601d
SHA3-384 hash:	4591f836bbb59aa7f3fa6c51c1739a4beb77a7dbcdf9d6f7f052d09099a1d1fe833dff110086f645e41b84a5a7a13ce2
SHA1 hash:	fb34281e91b8ec537a438e66f927009da72b07a3
MD5 hash:	3768fe51238c141f42cab373c8135963
humanhash:	beer-four-avocado-mirror
File name:	PI-BL_SHIPPING DOCUMENT.scr
Download:	download sample
Signature	Loki Create hunting rule
File size:	184'320 bytes
First seen:	2020-05-18 06:35:18 UTC
Last seen:	2020-05-18 11:46:58 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	140e1ff4cd8767608ceefff2e05187ce (1 x Loki)
ssdeep	3072:/u7oSVw1Luj/0z/SJa0xhZcv9xrVEybRWsy58J/:29wFum/SJRxg9N2K5y
Threatray	49 similar samples on MalwareBazaar
TLSH	41045B62F5D4AE02D621893E9FE586B8511ABCB04F11C90370863F5F3AF7946A772327
Reporter	abuse_ch
Tags:	Loki Maersk scr

abuse_ch

Malspam distributing Loki:

HELO: rance.com
Sending IP: 173.82.243.253
From: Maersk Line Container Logistics & Supply Chain Services Container Logistics & Supply Chain Services <ca.export@maersk.com>
Subject: ATTN: PI&BL URGENT_SHIPPING_DOCUMENT%
Attachment: PI-BL_SHIPPING DOCUMENT.gz (contains "PI-BL_SHIPPING DOCUMENT.scr")

Loki C2:
http://lmpulsefashion.net/four/gates3/fre.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.Siggen9.46843.32253.7741.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Injector

Status:

Malicious

First seen:

2020-05-17 21:40:43 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 30 (76.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=olpt7gsjjlanqspknorzc7p4g7lsoxyxb4atjdj72kwxp6z5maoq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

persistence

Link:

https://tria.ge/reports/201109-9nj2x5cm62/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Checks QEMU agent state file

Loads dropped DLL

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Lokibot Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com