MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0375f45e25b7fca1f49141cd56cf164e09c43c210778b126e91b385d84961efc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	0375f45e25b7fca1f49141cd56cf164e09c43c210778b126e91b385d84961efc
SHA3-384 hash:	636b624ce1dd066cc03c71d58031f2a385301e6c7dd53a8855855e808240175e09b3cc94efd2174fa0ef0b9c54a8a012
SHA1 hash:	0c6ac0dd1b22413d0ca01013e0598aad1c0c3f26
MD5 hash:	35b34ec6dfed891e23a4a63aec049e1c
humanhash:	beer-cola-east-island
File name:	NEW ORDER.zip
Download:	download sample
Signature	Loki Create hunting rule
File size:	492'844 bytes
First seen:	2021-07-10 06:02:45 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:2/1oHCSVvAzilk+CrHfBsOEuZCIgZi0QPPkfR2CPfMtL7A:29o6KcfBDZC3Zi0QPPkfRjYw
TLSH	T16AA4232ADD09EF420520251963FD8E70A368669D01E169A05837B9FCAB4B427897372F
Reporter	cocaman
Tags:	Loki zip

cocaman

Malicious email (T1566.001)
From: ""Purchasing Manager"<cheryl@acmelaser.cn>" (likely spoofed)
Received: "from acmelaser.cn (unknown [103.155.80.90]) "
Date: "9 Jul 2021 11:23:12 -0700"
Subject: "Re:Re:Re: Additional New Order & Request for catalog and price list"
Attachment: "NEW ORDER.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

212

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.24143.ZipHeur.UNOFFICIAL

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/0375f45e25b7fca1f49141cd56cf164e09c43c210778b126e91b385d84961efc

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0375f45e25b7fca1f49141cd56cf164e09c43c210778b126e91b385d84961efc/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-07-10 06:03:08 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

15 of 46 (32.61%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=an27ixrfw76kd5erihgvntywjye4ipbba54lcjxjdm4f3bewd36a._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot spyware stealer trojan

Link:

https://tria.ge/reports/210710-96xzngwvhx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Lokibot

Malware Config

C2 Extraction:

http://185.227.139.18/dsaicosaicasdi.php/auJMYiGBL7JHG
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/0375f45e25b7fca1f49141cd56cf164e09c43c210778b126e91b385d84961efc