MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce4a0ce60b3b1484bcd89eb7d093d66600c83d52d33c57cf3a93f976e89c1acb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce4a0ce60b3b1484bcd89eb7d093d66600c83d52d33c57cf3a93f976e89c1acb
SHA3-384 hash: 78fe506a6621ba260f3f0e5e166bba2ce92fc50e098ea54cd1c5b4e8f30f710e56bedcac7beadfe29c6a9d5d932c8b3c
SHA1 hash: 9b173d26cae58456e6325f6fba9cd8ff40e411ec
MD5 hash: 7fa83ec48ab4dbcdd720defdcb36e974
humanhash: solar-sad-spaghetti-march
File name:INV #47001277710401 Bank Swift Copy_PDF.exe
Download: download sample
Signature Loki
Create hunting rule
File size:318'976 bytes
First seen:2020-06-23 06:23:14 UTC
Last seen:2020-06-23 13:32:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:Cd/qBkzYklWmuvbKgcwdWzzNboeVl/Tgd:DkzPWmuvbHcRhoAlcd
Threatray 1'572 similar samples on MalwareBazaar
TLSH 6864494D1348066FE9647A71C0AE7F50026126FD7D63EB7AB918B143FA137C69133A3A
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: slot0.farolexshippings.com
Sending IP: 185.130.215.157
From: Sanjay Kumar <sanjay@bdhme.com>
Subject: RE: INV #47001277710401 Bank Swift Copy 20200615
Attachment: INV 47001277710401 Bank Swift Copy_PDF.7z (contains "INV #47001277710401 Bank Swift Copy_PDF.exe")

Loki C2:
http://skullisland.ml/Broken/fre.php

Intelligence

File Origin
# of uploads :
3
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12840/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WMH.31075.UNOFFICIAL
Create hunting rule

Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ce4a0ce60b3b1484bcd89eb7d093d66600c83d52d33c57cf3a93f976e89c1acb/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-23 06:25:04 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zzfazzqlhmkijpgyt235be6wmyamqpks2m6fptz2sp4xn2e4dlfq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
1f304045d47cee09337e90918d6e57c52e45b18d8d773b93b1a8505a4780dd08
Loki
27bbe91594be31152fa354c65fe907b46e925c07736b61efa3929aa5457f7702
Loki
2920875227a99846d5be677db5ff05a24a88468ad68c35520983465c462353cf
Loki
3afe776d485af4d4795ac9a9c1a290f13f6cfdaa01c9c97d3e64ab1f3eb5d59d
Loki
6d08181d3e48d2c4cfaf32676792ad0954d64b2e12631b856b5a62ba7dc80099
Loki
7fae44d16f02634d7708d44749993a149f06a4597d35326d120668138defff82
Loki
a9055377b8ebe2b2d3890f4746a837610890f0453a487bdebd22a619737b1210
Loki
b1c1df9daeb93473a208117db8782e0a6245e3b8c6f13da6405a79a1e36ab821
Loki
edb0cd527a624908e5c07f5139b267e20954149e615fbb8a43dac2a3292756da
Loki
f9f9cc089c03696273c6c495f2cf53fefd5a93da5b5b4a4c39b6914ea1606088
Loki
+ 1'562 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
trojan spyware stealer family:lokibot
Link:
https://tria.ge/reports/200624-3yqazh87ze/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://skullisland.ml/Broken/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Lokibot
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

409876a6ede0702bdb66fd77d45ec9ec

Loki

Executable exe ce4a0ce60b3b1484bcd89eb7d093d66600c83d52d33c57cf3a93f976e89c1acb

(this sample)

  
Dropped by
MD5 409876a6ede0702bdb66fd77d45ec9ec
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/12840/

Comments