MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b4d55da62340d71ea45226007214ecfa33b00b09e9cbd48736eaaf51cfd8125. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 14

Intelligence 14 IOCs YARA 2 File information Comments 1

SHA256 hash:	0b4d55da62340d71ea45226007214ecfa33b00b09e9cbd48736eaaf51cfd8125
SHA3-384 hash:	9b3ed4f6b7ff46283c5ce0377abd7fc6be9b35a08d788e283a559aadf510c14ddcdfba06706ca96b249c8b3b4601132b
SHA1 hash:	73a29bf37b23a00c6b09db3b0c7c85c5883a4855
MD5 hash:	78e6a448f5f426c2a4afaca8e9b00fb1
humanhash:	twenty-florida-three-april
File name:	78e6a448f5f426c2a4afaca8e9b00fb1
Download:	download sample
Signature	Loki Create hunting rule
File size:	678'400 bytes
First seen:	2022-07-30 06:21:26 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:FNk4wxg+ugGp0/9HMkHB/CurBvL5lUrnV/7SdJPRonYzFU:w4wxgPGWUUuDyrV/wJpoIU
Threatray	12'476 similar samples on MalwareBazaar
TLSH	T14CE4CE60B5A88B22D26EE7F898B021106BF07C26252AE75D7DC574CE4CB7F544E76E03
TrID	72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.4% (.EXE) Win64 Executable (generic) (10523/12/4) 6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.4% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	zbetcheckin
Tags:	32 exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

462

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/295186/

Detection(s):

SecuriteInfo.com.Trojan.Zmutzy.Pong.2-1.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Enabling the 'hidden' option for analyzed file

Moving of the original file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/62e4ce489ca9b9bfcbdd8a06/reports/82b540cf-90c7-4268-9c99-52791149a204/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/af8563ef-a1bf-4b57-945c-c6e42d36aaa3

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1043455

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected AntiVM3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/0b4d55da62340d71ea45226007214ecfa33b00b09e9cbd48736eaaf51cfd8125/

Threat name:

ByteCode-MSIL.Spyware.Negastea

Status:

Malicious

First seen:

2022-07-28 14:07:04 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

21 of 25 (84.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bngvlwtcgqgxd2sfejqaoikoz6rtwafqt2ol2sdtn2vpkhh5qesq._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/220730-g4xe8sgfe3/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://xhvbzueifhdbjdfywete4y8va.cf/BN6/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

39c2d879c57f07305ce60412dc8a88f02e51f1a14a06cc605768d1d7f5313807

MD5 hash:

db51fe170a9e5d6ec5429a2fbd9d0353

SHA1 hash:

e30a58125fc41322db6cf2ccb6a6d414ed379016

Link:

https://www.unpac.me/results/f40aaa71-8c60-4e2d-9616-1ec5862941d2/

SH256 hash:

6be7a53f5f3fde784f487da1b524eac3fb23cafaf98a28e34d39af5f72863cf9

MD5 hash:

030fc60ab24156657733ed9c9fc2ca6d

SHA1 hash:

cece7b31fefd2df2680e8525017cac31d386ada6

Link:

https://www.unpac.me/results/f40aaa71-8c60-4e2d-9616-1ec5862941d2/

SH256 hash:

6fadf06ebf48d57077bc6276ff7b5173b5247557a02f14d565b92582c35a8d44

MD5 hash:

023cb4cc705b745976ab7e952a8ec2c5

SHA1 hash:

8f2aa925ff8a10d1bbdb8986aa74b61cace6245f

Link:

https://www.unpac.me/results/f40aaa71-8c60-4e2d-9616-1ec5862941d2/

SH256 hash:

7e7e732f6853c1af49a00802996a3554a7ed9bbfba052d77e782306a5f889e45

MD5 hash:

96135981d6a266fc0d42786a3c8324ba

SHA1 hash:

50ed8cf4ba38aeabfe8f675a7ec019540f37dde9

Detections:

win_lokipws_g0

win_lokipws_auto

lokibot

Link:

https://www.unpac.me/results/f40aaa71-8c60-4e2d-9616-1ec5862941d2/

Parent samples :

0b4d55da62340d71ea45226007214ecfa33b00b09e9cbd48736eaaf51cfd8125
35e5a6af1328a60cb4270aa549e1865a2b313e3d5ea20bf96a51f98a89b52bdf

SH256 hash:

a9c5b2c628a47247402ff05d399855caf6f6a22146d44cd0fd9d7fc05a65ba66

MD5 hash:

228ff1006be83039e4de2b5e0475a5b0

SHA1 hash:

3adef5cc343067fa6b9d5e712114dc619c867a72

Link:

https://www.unpac.me/results/f40aaa71-8c60-4e2d-9616-1ec5862941d2/

SH256 hash:

0b4d55da62340d71ea45226007214ecfa33b00b09e9cbd48736eaaf51cfd8125

MD5 hash:

78e6a448f5f426c2a4afaca8e9b00fb1

SHA1 hash:

73a29bf37b23a00c6b09db3b0c7c85c5883a4855

Link:

https://www.unpac.me/results/f40aaa71-8c60-4e2d-9616-1ec5862941d2/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0b4d55da6234/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/0b4d55da62340d71ea45226007214ecfa33b00b09e9cbd48736eaaf51cfd8125

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

exe 0b4d55da62340d71ea45226007214ecfa33b00b09e9cbd48736eaaf51cfd8125

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2262813/

Cape

https://www.capesandbox.com/analysis/295186/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-07-30 06:21:30 UTC

url : hxxp://192.3.122.162/44/vbc.exe