MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 18


Intelligence 18 IOCs YARA 19 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650
SHA3-384 hash: 6e3738d1990d4415701887773805c8ce763c175bdabc4c550edd1edc10be3d3e64506544f9e9599412a3a63583034617
SHA1 hash: 078739cb7a123491a2d32704af94a06a203a0bea
MD5 hash: 6290e8c6864aba9ef50803c9438c3276
humanhash: beer-uncle-uncle-robert
File name:wkCJ2z5pJkZ1aY8.exe
Download: download sample
Signature Loki
Create hunting rule
File size:491'520 bytes
First seen:2023-11-15 02:17:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:/m2iN8JJISlQPFup7ZpOdZO0XBnLrESkvUJGbJflnNOD:/m1uJOkBp7ZYjO0BLrFkpbJfln
Threatray 4'106 similar samples on MalwareBazaar
TLSH T165A41221516C4BF0DCAAB7F6352761440377811EA222C75BCF82A5EE2BB3B41452DBE7
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter V3n0mStrike
Tags:exe Loki Lokibot


Avatar
V3n0mStrike
Fwd REQUEST FOR OFFER (Universidad de Buenos Aires) EUI894 BU463

Intelligence

File Origin
# of uploads :
1
# of downloads :
450
Origin country :
CL CL
Vendor Threat Intelligence
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
wkCJ2z5pJkZ1aY8.exe
Verdict:
Malicious activity
Analysis date:
2023-08-15 16:17:26 UTC
Tags:
trojan lokibot
Link:
https://app.any.run/tasks/4ba470df-e682-49de-be48-8168075626e9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/458643/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Sending a custom TCP request
Creating a process with a hidden window
Launching a process
Restart of the analyzed sample
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/65542a5b28bfca96f8ac6507/reports/c78d2af1-35c2-4c12-b21d-8284bf425db0/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/459d737c-166a-46ef-8198-161d99febd98
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1342765
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1342765 Sample: wkCJ2z5pJkZ1aY8.exe Startdate: 15/11/2023 Architecture: WINDOWS Score: 100 41 Multi AV Scanner detection for domain / URL 2->41 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 11 other signatures 2->47 7 wkCJ2z5pJkZ1aY8.exe 7 2->7         started        11 xAZabUFhB.exe 5 2->11         started        process3 file4 35 C:\Users\user\AppData\Roaming\xAZabUFhB.exe, PE32 7->35 dropped 37 C:\Users\user\AppData\Local\...\tmp16A7.tmp, XML 7->37 dropped 49 Uses schtasks.exe or at.exe to add and modify task schedules 7->49 51 Adds a directory exclusion to Windows Defender 7->51 53 Injects a PE file into a foreign processes 7->53 13 wkCJ2z5pJkZ1aY8.exe 54 7->13         started        17 powershell.exe 23 7->17         started        19 schtasks.exe 1 7->19         started        27 3 other processes 7->27 55 Antivirus detection for dropped file 11->55 57 Multi AV Scanner detection for dropped file 11->57 59 Tries to steal Mail credentials (via file registry) 11->59 61 Machine Learning detection for dropped file 11->61 21 schtasks.exe 1 11->21         started        23 xAZabUFhB.exe 11->23         started        25 xAZabUFhB.exe 11->25         started        signatures5 process6 dnsIp7 39 161.35.102.56, 49707, 49710, 49711 DIGITALOCEAN-ASNUS United States 13->39 63 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->63 65 Tries to steal Mail credentials (via file / registry access) 13->65 67 Tries to harvest and steal ftp login credentials 13->67 69 Tries to harvest and steal browser information (history, passwords, etc) 13->69 29 conhost.exe 17->29         started        31 conhost.exe 19->31         started        33 conhost.exe 21->33         started        signatures8 process9
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650/
Threat name:
ByteCode-MSIL.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2023-08-02 05:53:57 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
26 of 38 (68.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bknbupaddyhlnsjykeedafcpe34i577jiiylcrt6bejdhe5zszia._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
0edc218ce875571b4ad5323bf2f927e18f02d03a16b5778a4a2985b08a75af70
Loki
8b3068ebb19771dd9d8d0fbabda5cef3d8dd973b4aace949bd2c72bc4dc9779e
Loki
e2357821cf4c5c1991d7751e1ddad32d833979c37dcb9c51013b9bf403f615bf
Loki
ee604eadddc3b329f728854736a48df50072291bfe4e486b2f051adaef783af9
Loki
fa481461f81226d110758f769773791c5db4469ba2c9be3623f6cccc3362a309
Loki
+ 4'096 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/231115-cq92ysae62/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://161.35.102.56/~nikol/?p=8254674426
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
3f68cc843eb3b2a764dc02355e2e3f97dce8f1164d6f18a4f77e850410dfc137
MD5 hash:
60126f10641986bbcefca9ed6159994b
SHA1 hash:
df584155d49b10805f1f0d81a758e98b23990815
Link:
https://www.unpac.me/results/fc40cb5e-ab0a-44a3-98a1-2372bb7e378f/
SH256 hash:
35f635638695a5ce0a79565111e11cfcd8d59547d6b04cde2d45b5b2a7de7922
MD5 hash:
0fd2ad5079ffdcbda61afce86fe52247
SHA1 hash:
c437248ef3bf741ee02b1407c848a6367b79c334
Detections:
lokibot
Create hunting rule
win_lokipws_auto
Create hunting rule
win_lokipws_g0
Create hunting rule
STEALER_Lokibot
Create hunting rule
SUSP_XORed_URL_In_EXE
Create hunting rule
Lokibot
Create hunting rule
Link:
https://www.unpac.me/results/fc40cb5e-ab0a-44a3-98a1-2372bb7e378f/
Parent samples :
74c7307aa85a7a73d924dfcc7101941975b746d8d21b10e8807bf10ed19d3c02
5db6a8dfafd6956beaf4127500cd5232d78d70165a1775fa1da58277a43327ed
852e0d9a8f474077261d053d587868b211e70eff320a7e7067c3fc1cb3253ea5
0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650
SH256 hash:
1dcc2630a57a85ed362bccb7a130b957b1713acdd145f7399b6dd8c62955e8e0
MD5 hash:
8763642a17fce45aa4812017fa49cefa
SHA1 hash:
bcc969039730812b9d7501247b92f06a8779cf4a
Link:
https://www.unpac.me/results/fc40cb5e-ab0a-44a3-98a1-2372bb7e378f/
SH256 hash:
596048cbe7050f495fbacc2380b79bea1db2a4af7722fb2e5c6b2bc355c6171d
MD5 hash:
c8c91df46a4e8065119dc39f5a67b833
SHA1 hash:
9c952ceb8eeed5b84696a8eecaee22d487912d6c
Link:
https://www.unpac.me/results/fc40cb5e-ab0a-44a3-98a1-2372bb7e378f/
SH256 hash:
0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650
MD5 hash:
6290e8c6864aba9ef50803c9438c3276
SHA1 hash:
078739cb7a123491a2d32704af94a06a203a0bea
Link:
https://www.unpac.me/results/fc40cb5e-ab0a-44a3-98a1-2372bb7e378f/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0a9a1a3c031e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:LokiBot
Create hunting rule
Author:kevoreilly
Description:LokiBot Payload
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:malware_Lokibot_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:Windows_Trojan_Lokibot_0f421617
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Lokibot_1f885282
Create hunting rule
Author:Elastic Security
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

Executable exe 0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650

(this sample)

anyrun
any.run
https://app.any.run/tasks/ef29ca35-646f-4892-98ed-53b157fa8c50/
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/458643/

Comments