MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a26f49fc7f5dde3568e20c489de5cbd7069f87dbd60b50645427ae27d42565a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a26f49fc7f5dde3568e20c489de5cbd7069f87dbd60b50645427ae27d42565a
SHA3-384 hash: 53a97cedd0fd8d065444f550b8ceec32cf5b653cd04da2d88c4403f21fced2b72aaacb1c81efbf2371fd9fdd14826570
SHA1 hash: b180184c812aed260f9be4c843a35a2bf97d6aff
MD5 hash: 9116ea122ec777ed93a691d07f51fa3f
humanhash: football-mike-west-paris
File name:Purchase Order no20002746.exe
Download: download sample
Signature Loki
Create hunting rule
File size:1'157'120 bytes
First seen:2022-10-13 02:55:46 UTC
Last seen:2022-10-18 04:24:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 24576:pTzOa8GDZWEHZ4GPaLx3NQnNs80rU3eaG7J8ba:j8yIkK3NQnB0rYw+
Threatray 10'594 similar samples on MalwareBazaar
TLSH T1B0358B7512994903D12A32B5C887D1F32BF65D61A452D2C71AD73FAFBC843B7A21324B
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://192.64.118.167/profile.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://192.64.118.167/profile.php https://threatfox.abuse.ch/ioc/880535/

Intelligence

File Origin
# of uploads :
2
# of downloads :
318
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/319633/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63477e42aab5b3e31a6ae5bb/reports/64ac16c7-1233-4f7c-84db-3bdc78a9301c/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ef50d43d-7eb2-480a-9275-f29468bd8f8d
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1089388
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0a26f49fc7f5dde3568e20c489de5cbd7069f87dbd60b50645427ae27d42565a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-10-13 02:40:38 UTC
File Type:
PE (.Net Exe)
Extracted files:
18
AV detection:
25 of 41 (60.98%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bitpjh6h6xo6gvuoedcitxs4xvygt6d5xvqlkbsfij5oe7kckzna._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
04f557582bc8b4c4af843d0c837124da73f887ac5b997efdd78f96d45caced85
Loki
4e12ca0674f72503e00f35b8b27aa98da0855baa9e25264b357bb934e31a2217
Loki
7f0fcb4f3651ec6a3b273322857afe8aa8373f77964afd0bb592378a4a97fe1a
Loki
def88fc364ed03678d528bfd6bc39f19ff1831b098aaf0705fa13063c4044a2a
Loki
ec2a93f1858ba7e0de894944d57fb4b2f3021e5574d1b3594bfd8ffe32f7b029
Loki
f998a60cb95f390ca201950cf41b1764646f2f8ca91f13c05fbf78282518e741
Loki
fa4058c30f37d1cdb72e5bbcc467ff8f9b584b090bfdf723ac1f04817980096a
Loki
+ 10'584 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/221013-de1vksagb2/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://192.64.118.167/profile.php?id=l0O2wcpsyRCytFA4APkjYSK3tuCeqgFLhtONGege5SNzynD8cXsbPceiHRw78cTpFHdmVtA1mnAULd2Ybu91HojogQwo2p
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c3e4a9b7-9d1b-45d4-8385-e4977004b3ff
Unpacked files
SH256 hash:
fc8d6a92a8d51810d83b9f9bcb9900f3b94bbf250bd6079dc9dfc46e3e866412
MD5 hash:
2a57218ed54f52e24ebe61a04923ac16
SHA1 hash:
d5b597385a76b7f32d8101f77d8261d889da2690
Detections:
lokibot
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/0c0145dc-fe6a-4da5-abc4-1f2f134e9a54/
SH256 hash:
af7ac1171b44c9a949ad80bfaf05095048d0b74cfb527f66479e22f47d340110
MD5 hash:
f696dc0e00cb8f70799ac3fcaa5f9f6a
SHA1 hash:
cde2283de5b89639ea52f6388feef8f77efc63ce
Link:
https://www.unpac.me/results/0c0145dc-fe6a-4da5-abc4-1f2f134e9a54/
SH256 hash:
933fe0291b931fce6cdac0db1b1a3e980cc740770c37bbc09344beea6dedbbf9
MD5 hash:
739951ca4b85d4a0439a7916258f5927
SHA1 hash:
bebddc14a5cd8ddf084780b6a878361e1a1a3e36
Detections:
lokibot
Create hunting rule
win_lokipws_auto
Create hunting rule
win_lokipws_g0
Create hunting rule
Link:
https://www.unpac.me/results/0c0145dc-fe6a-4da5-abc4-1f2f134e9a54/
SH256 hash:
cce78c6d0c412c41f7db9a9bf8cad8fe2b9df99fe39de6dec9c449e27f43afd4
MD5 hash:
36de0c71eb4d024969100d03a2fece91
SHA1 hash:
3b24e5b042a22cb4c9a61bab260aa3b08ebdb785
Link:
https://www.unpac.me/results/0c0145dc-fe6a-4da5-abc4-1f2f134e9a54/
SH256 hash:
e20ec8f3c957bcb6a194ef688bae8af2015cfffb20e7baf8b2114d7b70ade4ee
MD5 hash:
35cb29046968faca7f3f3b4463449b6c
SHA1 hash:
088c8c30ec1bece0a4b5bbfe3982b073f8b95598
Link:
https://www.unpac.me/results/0c0145dc-fe6a-4da5-abc4-1f2f134e9a54/
SH256 hash:
0a26f49fc7f5dde3568e20c489de5cbd7069f87dbd60b50645427ae27d42565a
MD5 hash:
9116ea122ec777ed93a691d07f51fa3f
SHA1 hash:
b180184c812aed260f9be4c843a35a2bf97d6aff
Link:
https://www.unpac.me/results/0c0145dc-fe6a-4da5-abc4-1f2f134e9a54/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0a26f49fc7f5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0a26f49fc7f5dde3568e20c489de5cbd7069f87dbd60b50645427ae27d42565a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:LokiBot
Create hunting rule
Author:kevoreilly
Description:LokiBot Payload
Rule name:malware_Lokibot_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/319633/

Comments