MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0043c3f1ed670857f0a5d63148581c67c6878833bc767f194c77a6e9ddafb87b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 8

Intelligence 8 IOCs YARA 4 File information Comments

SHA256 hash:	0043c3f1ed670857f0a5d63148581c67c6878833bc767f194c77a6e9ddafb87b
SHA3-384 hash:	608f1494e5e29c17ab89cfeadd4e793f9e90da2b9e8a741a54ac9496dd9fa508e114243bb9c52939f84cccd3926513e0
SHA1 hash:	104a429fc50fdd1f568322159728dc987fd3e8c0
MD5 hash:	5c26c2104e849ff2a8628a3db9b0ef3c
humanhash:	one-tango-green-sierra
File name:	交易通知08·18·2020·pdf.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	689'152 bytes
First seen:	2020-08-18 11:46:28 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	e877e52c1d0025820b0d8228acf49bf6 (15 x AgentTesla, 14 x Loki, 4 x Formbook)
ssdeep	12288:y+p7p8KESESHe4/gD6WDSqWl/LDGTGM5irK+cBCotGxo:9tRES4DBSq2KG2bRBCxO
Threatray	1'477 similar samples on MalwareBazaar
TLSH	5DE47D2EB2EC443FC166253D9D3B97B47835BE102A285D866BE55C4F8F3D68138391A3
Reporter	abuse_ch
Tags:	CHN exe geo Loki

abuse_ch

Malspam distributing Loki:

HELO: mail.synch.hu
Sending IP: 193.39.14.202
From: 台北富邦銀行企業客服中心(系統自動發送請勿回覆本信件) <fbo@fubon.com>
Reply-To: payment@fubon.com
Subject: 台北富邦銀行-富邦商務網【外幣單筆交易】交易通知 Taipei Fubon Bank - Fubon Business Online 【FCY Single Payment 】Payment Notice
Attachment: 交易通知08·18·2020·pdf.zip (contains "交易通知08·18·2020·pdf.exe")

Loki C2:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/47762/

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Reading critical registry keys

Changing a file

Replacing files

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Sending a UDP request

Stealing user critical data

Connection attempt to an infection source

Moving of the original file

Sending an HTTP POST request to an infection source

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0043c3f1ed670857f0a5d63148581c67c6878833bc767f194c77a6e9ddafb87b/

Threat name:

Win32.Infostealer.Fareit

Status:

Malicious

First seen:

2020-08-18 00:48:57 UTC

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=abb4h4pnm4efp4ff2yyuqwa4m7dipcbtxr3h6gkmo6totxnpxb5q._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

spyware trojan stealer family:lokibot

Link:

https://tria.ge/reports/200818-2skmadd642/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://195.69.140.147/.op/cr.php/S7zr5v1fXI3Rb
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0043c3f1ed670857f0a5d63148581c67c6878833bc767f194c77a6e9ddafb87b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Lokibot Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	win_lokipws_g0 Create hunting rule
Author:	Slavo Greminger, SWITCH-CERT

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com