MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf30f4616da5cf69253a4d21081ebc43546835d2f5ec3164b74daecf5f94f5d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 8

Intelligence 8 IOCs YARA File information Comments

SHA256 hash:	bf30f4616da5cf69253a4d21081ebc43546835d2f5ec3164b74daecf5f94f5d2
SHA3-384 hash:	7da2a399bd5faff12790e902786c3528304b5d3af74d3518e3a3b4731633098b9017e38e1e4d40dc1334d4ecd5dec3d3
SHA1 hash:	a07bf7c795870b389754a5219cba1dc500e9e8c4
MD5 hash:	d81c29b22b384da36fad651a404135d3
humanhash:	lactose-nevada-nebraska-lemon
File name:	PO 200818-O1B.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	308'224 bytes
First seen:	2020-08-18 12:47:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:MrA4EcmZHyXFaxmVmie9bngP6qGAGN4se/+B9au07OLcpf9uuq4qds+d+bIOL1L:MrA4EcmZHAFaxmVmie9bngP5GPa/bJ7b
Threatray	1'476 similar samples on MalwareBazaar
TLSH	5764CF6C31E450A5F2F59BB5ADB02D08077E370F9525DE0B0E91A5A943F1BE0A817F2B
Reporter	abuse_ch
Tags:	CHN exe geo Loki

abuse_ch

Malspam distributing unidentified malware:

HELO: mail-smail-vm49.hanmail.net
Sending IP: 203.133.180.237
From: 구매부 김승준 과장 <lkj02250000@daum.net>
Subject: 견적 요청
Attachment: PO 200818-01B.cab (contains "PO 200818-O1B.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/47849/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Unauthorized injection to a recently created process

Reading critical registry keys

Creating a file

Changing a file

Replacing files

Connection attempt

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Stealing user critical data

Moving of the original file

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/bf30f4616da5cf69253a4d21081ebc43546835d2f5ec3164b74daecf5f94f5d2/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-08-18 12:49:06 UTC

AV detection:

23 of 27 (85.19%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x4ypiylnuxhwsjj2juqqqhv4inkgqnos6xwdczfxjwxm6x4u6xja._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

spyware trojan stealer family:lokibot

Link:

https://tria.ge/reports/200818-y85v7wkmpn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://79.124.8.8/plesk-site-preview/krockabread.com/http/79.124.8.8/kiriko/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bf30f4616da5cf69253a4d21081ebc43546835d2f5ec3164b74daecf5f94f5d2